To ensure that recommendations for enhancing internal controls have been effectively implemented, the internal auditor should conduct appropriate testing to verify management responses. This involves re- performing procedures, reviewing documentation, and possibly observing operations to confirm that the corrective actions have been adequately executed and are effective. Simply seeking a management assurance declaration (Option B) or observing corrective measures (Option A) may not provide sufficient evidence of proper implementation. Following up during the next scheduled audit (Option C) may delay the verification process, potentially allowing risks to persist.
IIA Standard 2500: Monitoring Progress.
IIA Practice Guide on Follow-up Processes in Internal Auditing.

Lagging indicators measure outcomes after the fact, while leading indicators provide predictive insight.
Return on investment (ROI) is the most lagging because it measures financial performance after investments and operations have already occurred.
* Customer retention (B) and employee satisfaction (C) are more intermediate indicators.
* Cost of R&D (D) is a leading indicator, as it influences future innovation.
Thus, ROI is the most lagging indicator.

According to the IIA's Fraud and Internal Audit position paper1, internal auditors should not investigate fraud unless they have the specific experience and expertise required to do so. Therefore, the most appropriate option for the chief audit executive is to appoint an independent fraud investigation specialist to work with the selected internal auditors. This will ensure that the investigation is conducted in a professional and ethical manner, and that the evidence is not compromised or tainted. The other options are not suitable because they do not address the immediate need for fraud investigation expertise, and they may expose the organization to legal or reputational risks.

According to the IIA guidance, the most appropriate next step when discovering a sales manager approving contracts beyond their authorization limit is to communicate the finding to the supervisor of the sales manager through an interim report. This approach ensures that the issue is addressed promptly and management can take immediate corrective actions to prevent further unauthorized activities. Including new contracts under negotiation in the final report would delay action, while reminding the sales manager of their authority limits does not escalate the issue appropriately.
IIA Standards: 2440 - Disseminating Results
IIA Practice Guide: Communicating Audit Results

The chief audit executive (CAE) has the responsibility to communicate audit results, including residual risks, to senior management. According to IIA Standard 2410 - Criteria for Communicating, the CAE should communicate the engagement's objectives, scope, conclusions, recommendations, and action plans. Residual risk, being a part of the audit outcome, should be reported at the same time as the audit results to ensure that senior management is fully informed of all aspects of the engagement. This allows senior management to understand the remaining risks after control measures have been applied.
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2410 - Criteria for Communicating