A key planning step for internal auditors to establish appropriate engagement objectives is to evaluate management's risk assessment and the internal audit activity's risk assessment. This step ensures that the audit focuses on areas of highest risk and aligns with the organization's risk management framework. By understanding and incorporating the organization's risk priorities, the internal auditors can design their engagements to provide maximum value and assurance regarding the control environment and risk management processes.
The Institute of Internal Auditors (IIA) Standard 2010: Planning
IIA Practice Advisory 2010-2: Using the Risk Management Process in Internal Audit Planning

When an internal auditor is unable to find supporting documentation for selected accounts during a test, the appropriate next step is to contact management to determine if the documentation is stored elsewhere. This ensures that all potential sources of evidence are explored before drawing any conclusions.
* IIA Standard 2310 - Identifying Information:
* This standard requires auditors to obtain sufficient, reliable, relevant, and useful information to support their findings. If documentation is missing, the auditor must investigate further to determine if the evidence exists in another location or form.
* Contacting Management:
* Before concluding that the test failed or expanding the sample, the auditor should first check with management to see if the documentation might be stored in an alternative location. This step ensures that the audit results are based on a thorough and complete examination of available evidence.
* IIA Practice Advisory 2330.A1-1:
* The advisory suggests that auditors should consider all sources of evidence and confirm with management if there are any alternative ways to obtain the necessary information.
* Option A (Conclude that the test failed): This conclusion would be premature without first attempting to locate the missing documentation.
* Option B (Select new accounts): This could lead to the same issue if the documentation is not missing but simply stored elsewhere.
* Option C (Expand the sample size): Expanding the sample is unnecessary if the issue is simply that the documentation is stored in a different place.
Detailed Explanation:Why Not Other Options?Conclusion: Option D is correct because it involves taking the logical next step of contacting management to locate the missing documentation, ensuring that the audit is thorough and the conclusions drawn are based on all available evidence, in line with IIA standards.

When reviewing the board of directors, internal auditors should consider testing the presence of an independent critical mass. This refers to the existence of a sufficient number of independent directors who can provide unbiased judgment and oversight. Independence is a cornerstone of effective governance, ensuring that decisions are made in the best interest of the organization without undue influence from management.
This attribute is crucial for maintaining the integrity and objectivity of the board's decisions and actions.
IIA's Practice Guide on Assessing Organizational Governance.

According to IIA guidance, to maximize the value of the current internal audit activity (IAA) resources, it is appropriate to hire external resources to provide subject-matter expertise while ensuring they are supervised (3). Additionally, assigning auditors to complex audits for learning opportunities helps in skill development and enhances the overall capability of the IAA (4). These strategies ensure that the IAA can address complex and high-risk areas effectively while also fostering professional growth among internal auditors. References:
IIA Practice Guide - Staffing the Internal Audit Activity, IIA Standard 2030 - Resource Management

Comprehensive and Detailed Explanation:
According to IIA Standard 2010 - Planning, the internal auditor must establish engagement objectives considering relevant risks to the activity under review. Even when an external investigator (corporate investigation team, regulator, or law enforcement) is addressing specific fraud incidents, the internal audit function still has a responsibility to evaluate fraud risks, related controls, and systemic weaknesses. Excluding fraud areas entirely (A) is inappropriate, as it ignores critical risks. Supporting investigators in an advisory- only role (B) may compromise independence, and option C only applies if the audit team lacks fraud expertise, in which case they may still assess control design without conducting the fraud investigation itself.
The best approach is Option D: the auditor should consider fraud risk and control weaknesses highlighted by the investigation and incorporate them into the audit scope. This ensures the audit adds value by focusing on systemic gaps that allowed the fraud to occur in the first place.