Audit observations are structured around the 4Cs: Condition, Criteria, Cause, and Consequence.
* Criteria = what "should be."
* Condition = what "is."
* Cause = why the deviation occurred.
* Consequence = effect or risk.
In this case, the correct criteria is that each invoice should be recorded only once in the accounting system (Option A). Options B and C describe condition and consequence, while Option D is irrelevant.

According to the Institute of Internal Auditors (IIA) guidance, workpapers are crucial for documenting the evidence that supports audit findings and conclusions. They serve as the primary reference for any reported control deficiencies, providing detailed documentation and justification for the audit results. Workpapers must be thorough and clearly demonstrate the basis for audit observations and recommendations. While audit reports summarize findings, the detailed support for these findings is found within the workpapers.
The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2330: Documenting Information.
IIA Practice Guide, "Audit Workpapers."

Professional skepticism is an essential attitude for internal auditors, particularly when assessing the risk of fraud. According to the IIA's Practice Guide "Internal Auditing and Fraud", one of the red flags that may heighten an internal auditor's professional skepticism is the presence of employees whose qualifications or credentials do not match the requirements of their positions. In this case, a procurement manager lacking the expected academic credentials raises concerns because it could indicate potential fraudulent activities such as unqualified decision-making or manipulation of procurement processes.
Reference: IIA Practice Guide "Internal Auditing and Fraud"

The engagement work program is primarily based on the scope and audit objectives of the engagement. The work program outlines the specific procedures to be followed during the audit to achieve the defined objectives within the scope of the engagement. It serves as a detailed plan that guides the audit team in their work, ensuring that all necessary areas are covered.
IIA References:
* IIA Standard 2240: Engagement Work Program states that internal auditors must develop and document work programs that achieve the engagement objectives. These work programs are directly tied to the scope and objectives of the audit, which determine the nature and extent of audit procedures.
* The Practice Guide on Engagement Planning explains that the work program should be designed to address the key risks and objectives identified during the planning phase, ensuring that the audit is comprehensive and focused on the most critical areas.

For a consulting engagement, planning typically occurs after the engagement objectives and scope have already been determined. In consulting engagements, the objectives and scope are usually agreed upon with the client at the outset, and planning activities then focus on how to achieve these objectives within the defined scope.
IIA Standards: 2010 - Planning
IIA Practice Guide: Consulting Services