The primary guideline for preparing audit engagement workpapers is that they should be understandable to another internal auditor who was not involved in the engagement. This ensures that workpapers are clear, complete, and sufficiently detailed so that another auditor can understand the work performed, the evidence gathered, and the conclusions reached without needing additional explanations.
IIA References:
IIA Standard 2330: Documenting Information requires internal auditors to document relevant information to support the conclusions and engagement results. The Practice Advisory 2330-1 emphasizes that workpapers should be understandable and provide a clear trail of the audit process and conclusions, facilitating peer review and quality assurance processes.
The IIA's Practice Guide on Audit Documentation suggests that workpapers should be prepared with the understanding that another internal auditor, unfamiliar with the work, may need to review them for quality assurance or other purposes.

Comprehensive and Detailed Explanation:
While professional experience and judgment are important, conclusions in internal audit must be supported by objective, sufficient, and reliable evidence (Standard 2310). Merely believing that bid prices are too high is not enough. The auditor must provide substantiated and comparative evidence (C) - such as market benchmarks, independent price analyses, or comparisons with similar tenders - to justify the conclusion. A description of policies (A) or tender process summaries (B) provide context but do not prove overpricing. An impact analysis (D) highlights consequences but does not establish whether prices were indeed unreasonable.
Therefore, the correct requirement is to gather and document comparative evidence that supports the auditor's professional judgment.

Flowcharts are particularly effective for visualizing linear processes, as they clearly depict the sequence of steps, decision points, and flow of information. However, while they provide a useful representation of the process, they may not capture all risks, particularly those that are non-linear or involve complex interactions that are not easily represented in a flowchart format.
IIA References:
* IIA Standard 2320: Analysis and Evaluation requires internal auditors to evaluate the design and implementation of processes. Flowcharts can help auditors visualize and understand process flows but may need to be supplemented with other tools (e.g., risk and control matrices) to capture the full range of risks.
* The Practice Guide on Process Mapping indicates that flowcharts are valuable for mapping linear processes but should be used in conjunction with other tools when evaluating complex or non-linear processes.

The most effective time for an internal auditor to develop a risk and control matrix is during the planning phase of an audit engagement. This matrix helps in identifying the key risks and the controls in place to mitigate those risks, which is crucial for developing a focused and effective engagement work program.
IIA References:
* IIA Standard 2201: Planning Considerations requires internal auditors to consider significant risks and controls when planning the engagement. Developing a risk and control matrix at this stage ensures that the audit work is appropriately targeted at the most critical areas.
* The Practice Guide on Risk Assessment advises that creating a risk and control matrix during planning helps in structuring the audit to address identified risks effectively.

Control self-assessment (CSA) processes typically emphasize the inclusion and evaluation of both formal (hard) and informal (soft) controls. The exclusion of informal, soft controls is not an outcome of an effective CSA process. Instead, CSA encourages a comprehensive review of all control types to enhance risk management and control effectiveness. References: = IIA's Practice Guide on Control Self-assessment.