The CIA exam emphasizes the importance of aligning performance measures with stakeholder expectations.
A customer-oriented provider should focus not just on internal metrics (time, cost, budget) but on what customers and stakeholders expect in terms of service levels, reliability, and responsiveness. Option D reflects the best criterion for a customer-driven organization.

The chief audit executive (CAE) is responsible for the approval of the engagement objectives and scope in internal auditing. While senior management, the head of customer service, and the board of directors may provide input and have interests in the audit engagement, it is ultimately the CAE who has the final authority to approve the objectives and scope. This ensures that the internal audit activity remains independent and that the engagement aligns with the overall audit plan and organizational priorities.
The Institute of Internal Auditors (IIA) Standard 2010 - Planning
IIA Standard 2200 - Engagement Planning

* A. Vendor contracts:While vendor contracts may reveal terms, they do not directly identify potential conflicts of interest.
* B. Employee master list:Correct. Comparing the employee master list with vendor information can help identify conflicts of interest, such as vendor ownership or employee relationships.
* C. Payment records:Useful for verifying transactions but not for identifying conflicts of interest.
* D. Purchasing policy:Provides guidelines but does not assist directly in identifying conflicts.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Identifying and Mitigating Conflicts of Interest.

Omitting advance client notice when planning an audit engagement is justifiable if the engagement includes audit assurance procedures that involve sensitive or restricted assets. Providing advance notice in such cases could compromise the integrity of the audit, as it may give management an opportunity to conceal or alter the status of these assets. The goal is to ensure that the auditors can observe the actual condition and handling of sensitive assets without any prior alteration. References: IIA Standard 2201 - Planning Considerations, IIA Practice Advisory 2201-1

Before developing the audit work program, it is essential to review the contract for evidence of authorization.
This step ensures that the contract is valid and approved by the appropriate parties, forming a critical basis for the compliance audit. By confirming authorization, the auditor can ascertain that the contract is legitimate and enforceable, and understand its key terms and conditions, which is necessary for planning and executing the audit effectively. Other steps, such as selecting a sample or assessing risks, are important but should follow after understanding the contract's validity and scope.
Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2201 - Planning Considerations.