* Tracing starts with source documents (e.g., receiving reports) and follows them forward through invoices and accounting entries to ensure completeness.
* Vouching starts with recorded entries and looks backward to supporting documents, testing validity.
* Independent confirmation involves external verification (e.g., with vendors).
* Reperformance involves redoing a control activity.
Here, the test begins with receiving documents and traces forward to invoices and postings, making tracing the correct procedure (Option B).

Understanding a business process involves several steps, with determining the process goals being the next logical step after identifying the process. The goals provide context for why the process exists and what it aims to achieve.
IIA Standard 2201 - Planning Considerations:
This standard emphasizes the importance of understanding the objectives and goals of the area under review.
Identifying the goals of a business process is crucial for evaluating its effectiveness and alignment with organizational objectives.
Process Goals:
The process goals define the purpose and desired outcomes of the process. Without understanding these goals, an auditor cannot effectively assess whether the process is functioning as intended or if it needs improvement.
IIA Practice Advisory 2201-1:
This advisory suggests that auditors should first understand the objectives (goals) of the process before delving into the details of inputs, activities, and outputs. The goals provide a framework for evaluating the relevance and effectiveness of these elements.
Option A (Determine process outputs): Outputs are important, but they should be understood in the context of the goals they are intended to achieve.
Option B (Determine process inputs): Inputs are the resources used in the process, but their relevance depends on the process goals.
Option C (Determine process activities): Activities are the steps within the process, but they must be aligned with the goals to be meaningful.
Detailed Explanation:Why Not Other Options?Conclusion: Option D is correct because understanding the process goals is the next logical step after identifying the process, as it provides the context needed to evaluate all other aspects of the process.

Comprehensive and Detailed Explanation:
The most objective way to validate hours worked is to cross-check billed hours with independent evidence of presence - such as access logs (C) from security or entry systems. This provides direct evidence that contracted personnel were on-site.
* Option A (due diligence review) focuses on vendor selection, not time validation.
* Option B relies on vendor-supplied data, which may be manipulated.
* Option D provides insights but is subjective.
According to IIA Standard 2310, evidence must be reliable and verifiable. Access logs provide such assurance, making Option C the strongest choice.

Data analytics is the most efficient technique to identify patterns and anomalies that may indicate the splitting of planned purchases to avoid the approval process. By applying data analytics, the internal auditor can analyze the entire dataset to detect unusual patterns, such as multiple purchases just below the approval threshold made within a short timeframe. This method is more effective than random sampling or manual examination as it can quickly and accurately identify instances of potential malpractice across large volumes of transactions.
The Institute of Internal Auditors (IIA) - Practice Guide: Data Analytics