According to the Institute of Internal Auditors (IIA) guidance, organizations have the most influence over the
"opportunity" aspect of the fraud triangle. The fraud triangle consists of three elements: pressure, opportunity, and rationalization. While pressure and rationalization are largely influenced by personal and external factors beyond the organization's direct control, opportunity refers to the circumstances that allow fraud to occur, which can be directly managed and controlled by the organization through internal controls, policies, and procedures. References: = IIA's "Managing the Business Risk of Fraud: A Practical Guide" and the IIA's Practice Guide on "Internal Audit's Role in Preventing and Detecting Fraud".

The internal audit charter outlines the internal audit activity's purpose, authority, and responsibility within the organization.
It defines the internal audit activity's position within the organization, including reporting lines, independence, and access to records, personnel, and physical properties relevant to the performance of engagements.
This clarity helps ensure that the internal audit activity can operate independently and effectively

Stratified sampling is used when the population can be divided into distinct subgroups (strata) that differ significantly from each other but are internally homogeneous. In the context of auditing, revenue earned through cash receipts or as receivables would have different characteristics and risk profiles. Stratifying the population allows the auditor to ensure that each subgroup is adequately represented in the sample, leading to more reliable and accurate audit conclusions.
The Institute of Internal Auditors (IIA) Practice Guide: Audit Sampling IIA Standard 2320 - Analysis and Evaluation

If operational management has not implemented effective actions to address a significant control breach, the most appropriate next step for the chief audit executive is to discuss the matter with senior management. This step involves escalating the issue to a higher level of authority to ensure that the risks associated with the control breach are properly understood and addressed. If senior management fails to take appropriate action, the CAE may then escalate the issue to the board.
IIA Standard 2500: Monitoring Progress
IIA Practice Guide: Auditing Organizational Governance

The primary reason for conducting a preliminary risk assessment during engagement planning is to ensure that significant risks are included in the engagement scope. This assessment helps the internal auditor focus on areas of highest risk, ensuring that the audit provides the most value by addressing the most critical issues that could impact the organization's objectives.
IIA Standards: 2201 - Planning Considerations
IIA Practice Guide: Engagement Planning