A crisis management plan must primarily define what management will actually do when the crisis occurs
. Therefore, Option D is the strongest answer. A practical crisis plan establishes actions, responsibilities, decision-making processes, escalation mechanisms, and steps for maintaining or restoring critical activities.
IIA guidance on organizational resilience emphasizes planning for actions before, during, and after disruptive events and establishing clear responsibilities for responding to incidents. Option A provides historical information from a previous exercise, while Option B addresses only the narrower technical issue of backup restoration. Option C contains internal audit recommendations, but responsibility for managing organizational risks and executing the crisis response belongs to management. Consequently, documented management activities constitute the most critical operational component of the crisis management plan.

The most effective step in helping the auditor determine whether fraud exists after observing a double payment transaction on a supplier invoice is to perform data analytics on the supplier's information, invoiced amounts, and payments performed. Data analytics allows the auditor to systematically analyze large volumes of transactions to identify patterns, anomalies, and potential fraudulent activities. This approach is more comprehensive and effective in uncovering fraud than simply extending the audit scope or switching to a fraud investigation engagement without a thorough initial analysis.
IIA Standards: 1220.A1 - Due Professional Care
IIA Practice Guide: Auditing for Fraud

A). The decision affects the test procedures performed:Correct. The choice between statistical and nonstatistical sampling affects the design of the sample selection, execution of audit procedures, and the nature of conclusions drawn. Statistical sampling involves probabilistic techniques that influence sample size and evaluation, whereas nonstatistical sampling relies on auditor judgment.
B). The auditor ' s response to errors detected will be influenced:While error response is critical, it is influenced more by the nature and materiality of the errors than by the sampling approach.
C). The competence of the evidence obtained is greater with statistical sampling:This is incorrect because the competence of evidence depends on the procedure itself, not the sampling method used. Both methods can yield competent evidence if applied correctly.
D). Nonstatistical sampling may be more cost effective:While this can sometimes be true, it is context- dependent and not universally applicable, so it is not the best answer.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Sampling Techniques and Audit Evidence.

Conducting a documented skills assessment helps in identifying the existing competencies and any gaps within the internal audit team.
Post-audit surveys can provide feedback on the performance and areas for improvement, which can be used to further refine the skills and competencies of the audit staff (Ref: [16 source] )

The internal audit activity's role in regard to the organization's risk management program includes ensuring that a proper and effective risk management process is in place. This involves evaluating the risk management processes and providing assurance that risks are identified and managed effectively. The internal audit activity should not be responsible for managing risks (Option A), but should ensure there is a systematic process (Option B). Attaining an adequate understanding of key mitigation strategies (Option C) and identifying appropriate controls (Option D) are part of the audit process, but ensuring the existence of a proper process is the primary responsibility. References: IIA Standard 2120 - Risk Management