* Definition of Risk Appetite: Risk appetite is the amount and type of risk an organization is willing to pursue or retain to achieve its objectives. It reflects the organization's overall approach to risk-taking and is typically articulated at the highest level of the organization.
Reference: COSO's Enterprise Risk Management Framework.
Definition of Risk Tolerance: Risk tolerance refers to the acceptable variation relative to the achievement of specific objectives. It is more granular and specific than risk appetite, detailing the levels of risk that are acceptable within the parameters set by the organization's risk appetite.
Reference: IIA's Practice Guide on Risk Management.
Distinguishing the Two Concepts: Risk appetite is broad and sets the overall boundaries for risk-taking, while risk tolerance is more specific, outlining acceptable risk levels for particular objectives within the broader risk appetite framework.
Practical Example: An organization may have a high risk appetite, accepting significant risks to achieve growth, but its risk tolerance for operational risks (such as system failures) may be low, indicating minimal acceptable deviations from expected performance.
Conclusion: The correct answer is C, as risk appetite represents the organization's general level of risk acceptance, whereas risk tolerance is more specific and detailed, falling under the broader scope of risk appetite.

The efficiency of an audit is greatly influenced by the adequacy of preliminary survey information. Thorough preliminary surveys help auditors understand the audit scope, identify potential issues early, and plan their work efficiently, thereby increasing overall audit efficiency. References: = IIA Practice Guide: "Engagement Planning: Establishing Objectives and Scope" and IIA Standard 2201 - Planning Considerations.

In the five-attribute approach to documenting deficiencies, the attribute that answers the question "What should be in place?" is Criteria. Criteria represent the standards, measures, or expectations used in making an evaluation and/or verification (what should be). It defines what the process or control should achieve, serving as a benchmark against which the actual condition (what is) is compared. The criteria are essential for identifying deviations and determining the nature and significance of deficiencies.
IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2410 - Criteria for Communicating.

The CIA exam emphasizes the importance of aligning performance measures with stakeholder expectations.
A customer-oriented provider should focus not just on internal metrics (time, cost, budget) but on what customers and stakeholders expect in terms of service levels, reliability, and responsiveness. Option D reflects the best criterion for a customer-driven organization.

When a significant finding is noted early during a review of the accounts payable function, the best course of action for communicating the issue is to inform internal accounting management via an interim memorandum update. This allows for timely communication and potential early remediation actions, ensuring that management is aware of the issue and can address it promptly before the final audit report is issued.
References:
The Institute of Internal Auditors (IIA) Standards
Internal Audit Communication and Reporting Protocols