According to IIA guidance, if the internal audit activity does not have sufficient time to complete its usual root cause analysis, the chief audit executive (CAE) may recommend that management conduct further work to identify the root cause and address the issue. This approach ensures that the root cause is still identified and addressed without delaying the audit report, maintaining the integrity and usefulness of the audit findings while leveraging management's resources.
IIA Standards: 2410.A1 - Criteria for Communicating
IIA Practice Guide: Root Cause Analysis

When an internal auditor is unable to find supporting documentation for selected accounts during a test, the appropriate next step is to contact management to determine if the documentation is stored elsewhere. This ensures that all potential sources of evidence are explored before drawing any conclusions.
* IIA Standard 2310 - Identifying Information:
* This standard requires auditors to obtain sufficient, reliable, relevant, and useful information to support their findings. If documentation is missing, the auditor must investigate further to determine if the evidence exists in another location or form.
* Contacting Management:
* Before concluding that the test failed or expanding the sample, the auditor should first check with management to see if the documentation might be stored in an alternative location. This step ensures that the audit results are based on a thorough and complete examination of available evidence.
* IIA Practice Advisory 2330.A1-1:
* The advisory suggests that auditors should consider all sources of evidence and confirm with management if there are any alternative ways to obtain the necessary information.
* Option A (Conclude that the test failed): This conclusion would be premature without first attempting to locate the missing documentation.
* Option B (Select new accounts): This could lead to the same issue if the documentation is not missing but simply stored elsewhere.
* Option C (Expand the sample size): Expanding the sample is unnecessary if the issue is simply that the documentation is stored in a different place.
Detailed Explanation:Why Not Other Options?Conclusion: Option D is correct because it involves taking the logical next step of contacting management to locate the missing documentation, ensuring that the audit is thorough and the conclusions drawn are based on all available evidence, in line with IIA standards.

When deciding whether to report a finding, the sufficiency of the information is critical. Sufficiency refers to the quantity of information obtained to support audit conclusions and recommendations. In this case, the internal auditors need to ensure that the sample size and the evidence collected are adequate to demonstrate that the issue of employees signing purchase orders in a designated acting capacity due to employee absence is significant enough to report. Ensuring sufficiency helps validate that the finding is well-supported and justifies its inclusion in the audit report.
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2310 - Identifying Information

When an internal auditor identifies a potential control deficiency based on a preliminary survey, such as the lack of established procedures for adding and approving new vendors, the next appropriate step is to gather more detailed information. Interviewing personnel involved in the accounts payable function allows the auditor to understand the context, confirm the accuracy of the questionnaire responses, and gain insights into the potential risks and impacts associated with the observed deficiency. This step is crucial before documenting the issue or planning further audit procedures to ensure the information is accurate and complete.
The IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2201 - Planning Considerations.

According to Standard 2340 - Engagement Supervision, engagement work must be properly supervised to ensure that objectives are achieved, quality is maintained, and staff are developed. Supervision is not limited to approving the engagement program at the beginning; it requires ongoing review of workpapers and fieldwork throughout the engagement. This includes providing timely feedback, asking clarifying questions, and ensuring consistency and sufficiency of evidence.
In this case, the supervisor only reviewed the work program at approval and after completion, which is inadequate. The required improvement is regular, ongoing review of workpapers and guidance throughout the engagement. This directly aligns with Standard 2340's requirement for continuous supervision rather than only final review.