The Chief Audit Executive (CAE) would be justified in reporting the situation to the organization's board if, in the opinion of the CAE, the level of residual risk assumed by senior management is too high (1). Even though the new process of obtaining written approval by the vice president of sales addresses the issue, if the CAE believes that the residual risk remains too high, it is their duty to report it to the board. The cost of implementing a preventive control or the compliance with the new process does not change the responsibility of the CAE to report significant residual risks to the board.
:
The Institute of Internal Auditors (IIA) Standard 2600 - Communicating the Acceptance of Risks: "When the chief audit executive believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the decision regarding residual risk is not resolved, the chief audit executive must report the matter to the board for resolution." IIA Practice Guide on "Communicating Risk Acceptance to the Board"

Analytical procedures involve evaluating financial and operational information by comparing it with expected values. These expectations can be based on historical data, industry benchmarks, budgets, or other relevant criteria. The primary purpose of analytical procedures is to identify any unusual or unexpected variations that could indicate potential issues or areas requiring further investigation.
IIA References:
* IIA Standard 2320: Analysis and Evaluation requires internal auditors to analyze and evaluate the information gathered during an engagement. Analytical procedures are a critical part of this process, as they help auditors identify trends, anomalies, and areas of risk by comparing actual results with expectations.
* The Practice Guide on Analytical Procedures defines these procedures as the analysis of relationships between different sets of data, with the goal of identifying inconsistencies or unexpected patterns.

A quality assurance and improvement program (QAIP) established by the chief audit executive (CAE) should ensure that the internal audit activity (IAA) adheres to the International Standards for the Professional Practice of Internal Auditing (Standards) and the IIA Code of Ethics. It should also aim to add value and improve the organization's operations. This comprehensive approach ensures that the internal audit function is not only compliant but also effective in enhancing the overall governance, risk management, and control processes within the organization.
:
IIA Standard 1300: Quality Assurance and Improvement Program.
IIA Standard 1320: Reporting on the Quality Assurance and Improvement Program.

In internal auditing, the use of Computer-Assisted Audit Techniques (CAATs) allows auditors to analyze large datasets efficiently and effectively. When it comes to fraud detection, analyzing the full population of data is often the best approach.
* IIA Practice Guide on CAATs:
* CAATs enable auditors to analyze entire datasets rather than relying on samples. This approach is particularly useful in fraud detection, where anomalies or fraudulent transactions may be rare and could be missed if only a sample is analyzed.
* Full Population Analysis:
* By analyzing the entire dataset, the auditor can identify patterns, anomalies, and outliers that could indicate fraudulent activity. This comprehensive approach increases the likelihood of detecting fraud.
* IIA Standard 1220 - Due Professional Care:
* This standard requires auditors to exercise due care, which includes considering the use of CAATs for fraud detection to ensure that all relevant data is reviewed, not just a subset.
* Option A (Data should remain segregated): Keeping data segregated may complicate the analysis and hinder the discovery of cross-division anomalies.
* Option C (Reactive approach): While tips and whistleblowing are important, a proactive approach using CAATs to analyze full populations is more effective in detecting fraud.
* Option D (Random sampling): Sampling may not be sufficient to detect fraud, as it could miss infrequent but significant fraudulent transactions.
Detailed Explanation:Why Not Other Options?

In the risk control map, Risk C is positioned in the upper left quadrant, indicating it is critical (high risk significance) but with a low level of control. This suggests that the current controls are insufficient to mitigate the high level of risk associated with Risk C. For critical risks, a higher level of control is necessary to ensure that the risk is properly managed and mitigated. References:
* "Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)
* "Risk Management Framework" (COSO)