Internal control questionnaires are used to determine whether specific control procedures are in place within an organization. They help auditors identify the existence and implementation of controls designed to mitigate risks. These questionnaires can provide a preliminary understanding of the control environment and identify areas that may require further detailed testing.
The Institute of Internal Auditors (IIA) Practice Guide: Using Internal Control Questionnaires to Assess Risk IIA Standard 2130 - Control

According to IIA guidance, the chief audit executive (CAE) has several appropriate options when the audit objectives are not complete despite the auditor having worked the full amount of budgeted hours. The CAE should determine if the work already completed is sufficient to conclude the engagement (2). The CAE should also provide feedback on areas of improvement for future engagements (3) and give instructions and directions to complete the audit (4). Allowing the auditor to decide whether to extend the audit engagement (1) is not typically an appropriate option as this decision should involve senior management or the CAE to ensure alignment with organizational priorities and resource allocation. References: = IIA Standard 2010 - Planning, IIA Standard 2020 - Communication and Approval, IIA Standard 2040 - Policies and Procedures.

In a consulting engagement agreement, it is crucial to clearly define the duties and responsibilities needed from management. This ensures that both the internal audit team and the management are aligned on their roles and what is expected from each party. Clear delineation of responsibilities helps prevent misunderstandings and sets a solid foundation for the engagement's success. References:
* IIA Standards - 2201: Planning Considerations
* IIA Practice Guide - Consulting Services

The internal audit charter outlines the internal audit activity's purpose, authority, and responsibility within the organization.
It defines the internal audit activity's position within the organization, including reporting lines, independence, and access to records, personnel, and physical properties relevant to the performance of engagements.
This clarity helps ensure that the internal audit activity can operate independently and effectively