Option C is correct. Before internal audit assesses activities performed by a third-party vendor, the auditor should determine whether the underlying contract provides the organization with a right to audit the vendor.
Such a clause establishes contractual authority to inspect relevant records, processes, systems, controls, or other evidence necessary to evaluate the vendor ' s performance and risk management. IIA third-party guidance specifically identifies right-to-audit provisions as an important contractual mechanism for obtaining information needed to monitor vendors. A termination clause establishes circumstances under which the contractual relationship can end. An indemnity clause allocates responsibility for specified losses, while a breach-of-contract clause addresses remedies when contractual obligations are violated. None of these independently provides the auditor with access to perform an assessment. Therefore, C is the critical clause to confirm during engagement planning.

Nonsampling risk is the risk that the auditor may reach incorrect conclusions for reasons not related to the sampling process, such as failure to recognize exceptions or misinterpretation of audit results. In this case, the internal auditor did not notice that some purchase requisitions were approved by unauthorized persons, which is an oversight unrelated to the sample size or selection process. This is distinct from sampling risk, which is the risk that the sample selected does not represent the population. References:
The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), Standard
2320 - Analysis and Evaluation.
The IIA's Practice Guide on Audit Sampling.

A periodic report from the chief audit executive (CAE) to the board typically includes information about the internal audit activity's purpose, authority, responsibility, and performance relative to the audit plan. This report ensures that the board is kept informed about the internal audit activity's alignment with organizational goals, its independence, and any significant issues or deviations from the plan.
IIA References:
* IIA Standard 2060: Reporting to Senior Management and the Board requires the CAE to report periodically to the board on the internal audit activity's purpose, authority, responsibility, and performance relative to its plan. This standard ensures that the board has a clear understanding of how the internal audit activity is fulfilling its role.
* The Practice Guide on Effective Communication with the Board recommends that the CAE provide regular updates on the internal audit activity's progress against its plan and any significant issues that require the board's attention.

When management decides not to implement a critical recommendation, especially one related to regulatory compliance and potential reputational risk, it is essential for the chief audit executive (CAE) to escalate the issue to senior management. This step ensures that management fully understands the risks involved and can make an informed decision.
IIA Standard 2600 - Communicating the Acceptance of Risks:
This standard requires the CAE to communicate to senior management and the board when management has accepted a level of risk that the CAE believes is unacceptable. The CAE must ensure that the decision-makers are aware of the potential consequences.
Importance of Escalation:
By convening a meeting with senior management, the CAE can discuss the risks of non-compliance, including potential regulatory sanctions and reputational damage. This discussion provides an opportunity for senior management to reassess the decision in light of these risks.
IIA Practice Advisory 2600-1:
The advisory suggests that when significant risks are not being addressed by management, the CAE should communicate these concerns to higher levels of the organization. This ensures that the risks are not ignored and that appropriate action can be taken.
Option A (Do nothing): This is not appropriate, as the CAE has a responsibility to escalate significant risks.
Option B (Contact regulatory agency): This is an extreme step and should not be the first course of action.
The issue should be discussed internally before involving external regulators.
Option D (Highlight to external auditors): While external auditors might need to be informed, the issue should first be addressed within the organization.
Detailed Explanation:Why Not Other Options?

Sorting the customer information is the most effective method for identifying duplicate accounts in a database of 100,000 customers. By sorting the database based on key identifiers such as customer name, address, or email, an internal auditor can quickly identify and review records that appear consecutively and have similar details, which is indicative of potential duplicates. This method is efficient and practical for handling large datasets.
References:
* Internal Audit Data Analytics Techniques
* Database Management Best Practices