Facilitated team workshops are the method of examining entity-level controls that involve gathering information from work groups that represent different levels in an organization. These workshops encourage interactive discussion and collaboration among participants from various departments and hierarchical levels, providing a comprehensive view of entity-level controls and promoting a better understanding of control processes and issues.
:
IIA Standards: 2210 - Engagement Objectives
IIA Practice Guide: Assessing the Adequacy of Risk Management Processes

According to IIA guidance, the chief audit executive (CAE) should maintain independence and objectivity in their role. While the CAE can manage and coordinate risk management processes, audit those processes, and be involved in risk oversight committees, they should not accept management's responsibility for risk management without the board's approval. This ensures that there is no conflict of interest and maintains the CAE's independence. References:
* IIA Standards - 1110: Organizational Independence
* IIA Practice Advisory - 2060-1: Reporting to Senior Management and the Board

Preparing a detailed audit program is a critical component of engagement planning. This program outlines the specific procedures and tests that the internal auditor will perform to evaluate the effectiveness of controls. It ensures that the audit is conducted systematically and thoroughly, addressing all relevant risks and objectives.
A detailed audit program provides a clear roadmap for the audit, helping to ensure that all necessary areas are covered and that the audit's objectives are achieved.
:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2201 - Planning Considerations

The IIA Standards emphasize that the chief audit executive (CAE) should develop the internal audit plan based on a thorough assessment of risks facing the organization. This risk-based approach ensures that the most significant and relevant areas are prioritized. While input from senior management and regulatory requirements are also important, the primary driver should be the most recent and comprehensive risk assessment. References:
* IIA Standards - 2010: Planning
* IIA Practice Guide - Developing the Risk-based Internal Audit Plan

According to the International Professional Practices Framework (IPPF), issuing an interim report is appropriate for keeping management informed of audit progress, especially when audit engagements extend over a long period of time, and for communicating any significant changes in the scope of the engagement.
Interim reports serve as a means of maintaining transparency with management and ensuring that any adjustments to the audit plan are communicated promptly.
IIA References:
* IIA Standard 2440: Disseminating Results allows for interim reporting when there is a need to communicate significant findings or changes in scope before the final report is issued. This ensures that management remains informed of critical issues that may impact the audit or the organization.
* The Practice Guide on Communicating Interim Results suggests that interim reports are useful for providing updates during long engagements or when there are significant changes in the engagement's scope that management needs to be aware of.