In internal auditing, evidence must meet certain criteria to support conclusions and recommendations.
According to IIA guidance, evidence should be sufficient, reliable, relevant, and useful. In this scenario, the internal auditor concludes that additional staff are needed to fully utilize a fraud surveillance system based on an employee's statement. However, the conclusion may lack sufficient evidence to support it.
* IIA Standard 2310 - Identifying Information:
* This standard requires that internal auditors identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives. "Sufficiency" refers to the quantity of evidence necessary to convince an informed person of the validity of the auditor's findings and recommendations.
* Sufficiency of Evidence:
* The auditor's conclusion about the need for additional staff is based on a single employee's remark, which is not sufficient evidence. The auditor would need to gather more evidence, such as analyzing workload data, reviewing system logs, or assessing staff capacity, to support the conclusion fully.
* IIA Practice Advisory 2310-1:
* This advisory emphasizes the need for auditors to obtain enough factual evidence to support their findings. Relying solely on anecdotal evidence from one employee does not meet the standard for sufficiency.
* Option B (Reliability): Reliability refers to the accuracy and credibility of the evidence. The employee's statement might be credible but still insufficient in quantity.
* Option C (Relevancy): The employee's comment is relevant to the issue, but relevancy alone does not make the evidence sufficient.
* Option D (Usefulness): The information could be useful, but it lacks the sufficiency needed to justify the auditor's conclusion.
Detailed Explanation:Why Not Other Options?

Administering control questionnaires to individuals with primary responsibilities in the process can yield valuable information about processes and controls. However, one significant drawback is that the information gathered may be limited regarding the actual functionality of the controls. This approach relies on the respondents' knowledge and perceptions, which may not accurately reflect the effectiveness of the controls in practice. Moreover, respondents might not fully understand the auditor's intentions or may provide biased or incomplete information, thereby limiting the depth of insights into how controls function in real-world scenarios.
:
IIA Standard 2201: Planning Considerations
IIA Practice Guide: Assessing the Adequacy of Risk Management Processes

Comprehensive and Detailed Explanation From Exact Extract:
The CIA exam emphasizes the importance of aligning performance measures with stakeholder expectations.
A customer-oriented provider should focus not just on internal metrics (time, cost, budget) but on what customers and stakeholders expect in terms of service levels, reliability, and responsiveness. Option D reflects the best criterion for a customer-driven organization.

* A. Vouching vendor invoices to payments made:This verifies payment accuracy but does not confirm whether purchases were authorized.
* B. Sorting invoices by purchase orders and comparing for successive duplicate invoices:This approach focuses on detecting duplicate invoices, not authorization.
* C. Comparing a random sample of vendor invoices to purchase orders:Correct. This method directly matches invoices to purchase orders, confirming that purchases were authorized and appropriately documented.
* D. Sorting payments by invoice to detect successive duplicate invoices:Similar to option B, this approach focuses on detecting duplicates rather than verifying authorization.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Testing for Authorization and Validity.

When proposing interim changes to the annual audit plan due to emerging risks, the most appropriate action for the CAE is to communicate with the CEO and present the revised audit plan to the board for approval.
This ensures that senior management is informed and supportive of the changes, and that the board, which holds the ultimate oversight responsibility, formally approves the revised plan. References:
* The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2020 - Communication and Approval.
* The IIA's Practice Guide on Engagement Planning.