When documenting findings from a nonstatistical sample, internal auditors should record the factual observations and quantify the results where possible. In this case, the auditor should document that 17% of the sampled accounts receivable balances exceeded the approved unsecured credit limit. This provides a clear, quantifiable basis for the finding, which is critical for accurate reporting and for management to understand the scope of the issue. Documenting this percentage also supports the auditor's conclusions and recommendations for corrective actions.
Reference:
The Institute of Internal Auditors (IIA) Practice Guide: Audit Sampling.
IIA Standard 2310 - Identifying Information

The most reliable source of testimonial evidence regarding whether a process is effectively performed according to its design would be the supervisor in charge of the process. This is because supervisors are typically responsible for overseeing the day-to-day operations and ensuring that processes are followed correctly. They have a comprehensive understanding of the process and can provide valuable insights into its effectiveness and adherence to design. The reliability of evidence increases with the proximity of the individual to the process in question and their role in ensuring compliance and performance.
Reference: IIA's Global Technology Audit Guide (GTAG) - Testimonial Evidence.

Step-by-Step Detailed Explanation:
A . Inform management and request that the plan be tested immediately:
Testing without updating the plan could lead to irrelevant results given the significant changes to the systems.
B . Update the recovery plan for management, as part of the review:
The auditor's role is to assess and recommend, not to perform management's responsibilities.
C . Evaluate the recovery plan and report weaknesses to management:
Evaluation alone does not address the need for an update and testing of the outdated plan.
D . Recommend that management and users update and test the recovery plan:
Correct. This approach addresses the deficiencies in the plan and ensures alignment with current systems.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Disaster Recovery and Business Continuity Planning.

According to IIA guidance, the chief audit executive (CAE) should maintain independence and objectivity in their role. While the CAE can manage and coordinate risk management processes, audit those processes, and be involved in risk oversight committees, they should not accept management's responsibility for risk management without the board's approval. This ensures that there is no conflict of interest and maintains the CAE's independence. Reference:
IIA Standards - 1110: Organizational Independence
IIA Practice Advisory - 2060-1: Reporting to Senior Management and the Board

To effectively communicate the acceptance of risk in an organization, a chief audit executive (CAE) must first consider the organization's view on risk tolerance. Understanding the organization's risk tolerance is crucial because it defines the level of risk the organization is willing to accept in pursuit of its objectives. This perspective guides how risks are communicated and managed across the organization.
Reference:
IIA Standards: 2120 - Risk Management
IIA Practice Guide: Assessing Organizational Governance in the Public Sector