Audit criteria should be appropriate and specific to each audit assignment, considering the unique context and objectives of each engagement. Consistency across all audit assignments (Option A) is not always feasible or desirable, as it could lead to inappropriate assessments. Instead, criteria should be flexible to allow the identification of nonadherence, represent reasonable standards, and align with good management practices relevant to each specific audit.
Reference:
IIA Standard 2201: Planning Considerations.
IIA Practice Guide on Audit Planning.

If senior management decides to accept risks, such as doing business with a questionable vendor, and the chief audit executive (CAE) believes this poses a significant risk to the organization, the CAE should escalate the issue to the board. The board has the ultimate responsibility for overseeing risk management and can decide on the appropriate action to take in response to the risk.
IIA Reference:
IIA Standard 2600: Communicating the Acceptance of Risks states that when the CAE believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the CAE must discuss the matter with senior management. If the decision regarding risk remains unchanged, the CAE must inform the board.
The Practice Guide on Risk Management highlights the importance of the CAE keeping the board informed of significant risks that management has chosen to accept, particularly when these risks could have a material impact on the organization.

When deciding whether to report a finding, the sufficiency of the information is critical. Sufficiency refers to the quantity of information obtained to support audit conclusions and recommendations. In this case, the internal auditors need to ensure that the sample size and the evidence collected are adequate to demonstrate that the issue of employees signing purchase orders in a designated acting capacity due to employee absence is significant enough to report. Ensuring sufficiency helps validate that the finding is well-supported and justifies its inclusion in the audit report.
Reference:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2310 - Identifying Information

When the internal audit activity lacks the necessary resources to complete the audit plan, the most appropriate action for the CAE is to ensure that the audit plan is still executed effectively and efficiently. Outsourcing some of the audits to the organization's external auditor, who is already familiar with the organization, can help mitigate resource constraints. This approach leverages the external auditor's knowledge of the organization, ensuring continuity and quality in the audit process, while allowing the internal audit function to meet its obligations and deadlines.
Reference:
IIA Standard 2030: Resource Management
IIA Practice Guide: Coordinating Internal Audit and External Audit

According to the IIA Standards, particularly in the context of risk management consulting, internal audit activities may provide risk management consulting services under specific conditions. These conditions include:
There is a clear strategy and timeline to migrate risk management responsibility back to management.
This condition ensures that the internal audit's involvement in risk management is temporary and transitional, emphasizing the principle that management retains ultimate responsibility for risk management.
The nature of services provided to the organization is documented in the internal audit charter.
This condition ensures transparency and clarity about the internal audit's role in risk management, as outlined in the internal audit charter. This documentation is essential for defining the scope and limitations of the internal audit's consulting role.
In contrast, options 2 and 3 are inappropriate under the Standards:
The internal audit activity has the final approval on any risk management decisions (Option 2): This would compromise the independence and objectivity of the internal audit function, as internal auditors should not make management decisions.
The internal audit activity gives objective assurance on all parts of the risk management framework for which it is responsible (Option 3): This creates a conflict of interest because internal auditors cannot objectively audit areas where they have direct responsibility.
IIA Reference:
IIA Standard 2050: Coordination and Reliance emphasizes that internal audit should not assume management responsibilities, including final risk management decisions, to maintain objectivity and independence.
IIA Standard 1000: Purpose, Authority, and Responsibility and related guidance stress the importance of documenting the internal audit's role in the audit charter, especially when the internal audit is involved in consulting activities like risk management.