Comprehensive and Detailed Explanation:
The scope of an engagement defines the boundaries of the audit - what areas, functions, activities, or processes will be reviewed. In this case, the engagement's purpose is to test adherence to the procurement policy, so the sub-processes (D) within procurement (e.g., vendor selection, purchase approvals, invoice processing) should be clearly defined in scope.
* Sample size (A) and procedures (C) are part of the audit work program, not scope.
* Inherent risks (B) are identified during planning but do not define scope boundaries.
Therefore, Option D is correct: defining sub-processes ensures that the audit scope is comprehensive and appropriately focused on procurement policy adherence.

Best practices for engagement planning involve setting objectives that align with the business objectives of the audit client. This ensures that the audit is relevant and provides valuable insights to the organization.
Planning should also be systematic and documented, ensuring that specific testing procedures and expected outcomes are outlined and communicated. References: = IIA Standard 2200 - Engagement Planning and IIA Practice Guide: "Planning the Engagement".

Comprehensive and Detailed Explanation:
Software development security requires internal auditors to understand change management processes (B) - how updates, patches, and new code are introduced and controlled to prevent vulnerabilities. While IT general controls (A) are important, they are broader (e.g., access, backup, operations). Fluency in programming languages (D) and proficiency in design software (C) are too technical and unnecessary for audit. Instead, auditors need to understand how changes are authorized, tested, and implemented, ensuring that the development process follows security and governance standards. According to Standard 1210 - Proficiency, internal auditors must have or obtain sufficient knowledge to evaluate relevant risks, making change management competency most critical.

The tone at the top refers to the ethical and cultural attitude demonstrated by senior leadership. If employees fear blame for reporting risks, this reflects a poor tone at the top. Changing leadership's attitude to encourage openness, transparency, and a no-blame culture is necessary to improve communication of risks. While accountability, leadership, and ethics matter, the root cause here is the tone at the top.

When an internal audit team leader encounters difficulties due to the lack of a system of internal controls, the most appropriate course of action is to add a consulting component to the scheduled assurance engagement.
This approach allows the internal audit team to provide advice and recommendations on establishing internal controls while still fulfilling their assurance responsibilities. By integrating consulting activities, the auditors can help the business unit improve its control environment, which can then be assessed in the assurance engagement.
The Institute of Internal Auditors (IIA) Practice Guide: Consulting Engagements IIA Standard 1130 - Impairment to Independence or Objectivity