According to IIA guidance, heat maps are tools used in risk assessment that visually represent the severity of risks by plotting them on a matrix based on their likelihood and impact. Heat maps are flexible and can be adjusted to prioritize either likelihood or impact depending on the specific context and the organization's risk appetite and tolerance. This recognition that the priority of impact and likelihood can vary allows for a more nuanced and tailored risk assessment approach.
IIA Practice Guide: Assessing the Risk Management Process
IIA Standard 2120: Risk Management

Workpapers from prior engagements provide context and background, especially regarding management's corrective actions and follow-up of past issues. They should inform planning, not dictate tests, scope, or risk assessment. Thus, the best benefit is understanding how prior issues were addressed, as stated in Option A.

Authority Source: The internal audit charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility. It grants internal auditors the right to access all records, personnel, and physical properties relevant to the performance of engagements.
Facilities Maintenance Reports: When an engagement supervisor contacts a third-party contractor for maintenance reports, the authority is derived from the internal audit charter, which ensures auditors have the necessary access to perform their duties.
Importance of the Charter: This ensures the independence and objectivity of the internal audit activity, providing a clear mandate for auditors to obtain information from external parties as needed.

During the planning stage of an assurance engagement, internal auditors should focus their attention on identifying and assessing inherent risks. Inherent risk is the risk of a material misstatement or noncompliance due to error or fraud that could occur before any controls are applied. Understanding inherent risk is crucial as it helps auditors identify areas that may need more extensive testing and ensures that audit resources are appropriately allocated to the highest risk areas.
The Institute of Internal Auditors (IIA) Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000 IIA Standard 2010 - Planning

Preparing a detailed audit program is a critical component of engagement planning. This program outlines the specific procedures and tests that the internal auditor will perform to evaluate the effectiveness of controls. It ensures that the audit is conducted systematically and thoroughly, addressing all relevant risks and objectives.
A detailed audit program provides a clear roadmap for the audit, helping to ensure that all necessary areas are covered and that the audit's objectives are achieved.
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2201 - Planning Considerations