According to IIA guidance, risk assessment is a critical step that precedes the development of audit engagement objectives. The risk assessment process helps internal auditors identify the key areas of risk within the organization, which then informs the setting of appropriate objectives for the audit engagement.
* IIA Standard 2201 - Planning Considerations:
* This standard requires internal auditors to consider risk when planning an engagement. The risk assessment process identifies the areas of highest risk, which allows the auditor to focus on the most critical issues during the engagement.
* Role of Risk Assessment:
* By assessing risks, the auditor can determine which processes or controls are most likely to affect the achievement of the organization's objectives. This understanding is essential for setting the audit engagement's objectives, ensuring that they are aligned with the areas of greatest concern.
* IIA Practice Advisory 2210.A1-1:
* The advisory suggests that auditors should use the results of the risk assessment to establish the scope, objectives, and priorities of the engagement. Without this risk assessment, the audit objectives may not fully address the most significant risks.
* Option A (Identification of controls): This typically occurs after the objectives are set, as controls are evaluated based on the identified risks.
* Option B (Scope establishment): The scope is determined after the objectives are set, which are based on the risk assessment.
* Option D (Review of resources): This step is related to the allocation of resources after the objectives and scope are defined.
Detailed Explanation:Why Not Other Options?

Comprehensive and Detailed Explanation From Exact Extract:
According to Standard 2240 - Engagement Work Program, work programs must be developed to achieve engagement objectives. The primary purpose is to guide the audit team in understanding the tasks, procedures, and testing steps necessary to accomplish objectives. While supervision and communication are secondary benefits, the main reason is to help auditors understand and execute their responsibilities (Option B).

According to the theory of constraints, the performance of any system is constrained by a few bottlenecks or limiting factors. These bottlenecks directly impact the organization's profitability because they limit the system's output, leading to reduced efficiency and effectiveness. Addressing these bottlenecks can lead to significant improvements in throughput, which in turn enhances profitability.
IIA References:
* The IIA's Practice Guide on Risk Management emphasizes understanding how various constraints within processes affect overall performance, including profitability. Bottlenecks are crucial factors that can either limit or boost profitability depending on how they are managed.

* A. To better understand and influence executives' planning:Influencing planning is not a primary purpose of networking.
* B. To make executives aware of the benefits that the internal audit activity can provide:Correct.
Networking ensures executives understand how internal audit can add value.
* C. To assist executives in setting the organization's risk appetite:Risk appetite is primarily a management responsibility.
* D. To have a better understanding of the training needed for the audit team:Training needs can be assessed through other means.
CIA Exam Syllabus Reference:
Domain IV: Managing the Internal Audit Function - Stakeholder Engagement.

Comprehensive and Detailed Explanation:
The governing body (board of directors) is responsible for strategic oversight. The most relevant evidence of their involvement in strategic social media decisions would be board meeting minutes (A), as these formally document discussions, approvals, and resolutions on strategic topics. Budget reports (B) reflect financial allocations but not governance involvement. Marketing plans (C) and procedures manuals (D) reflect management's role in execution, not the board's strategic oversight. According to IIA guidance on governance assessments (Standard 2110), auditors should look at evidence of board-level involvement in significant strategic initiatives. Thus, meeting minutes are the strongest and most direct evidence of governance participation in strategic decisions on social media use.