A significant governance issue that must be reported to the board is the absence of a formal risk management and control process, with risk management being solely the responsibility of operational managers. Effective governance requires a structured risk management framework overseen at the highest levels of the organization. The lack of such a process indicates a critical deficiency that can have severe implications for the organization's ability to manage and mitigate risks.
:
The Institute of Internal Auditors (IIA) Standard 2110 - Governance: "The internal audit activity must assess and make appropriate recommendations to improve the organization's governance processes."

For effective coordination of assurance coverage, the chief audit executive (CAE) should consider creating an assurance map. An assurance map provides a visual representation of the assurance activities across the organization, showing who is providing assurance, the areas covered, and the level of assurance provided.
This helps to identify gaps and overlaps in assurance coverage, enabling better coordination and optimization of resources. This approach is recommended by best practices in internal auditing as it aligns assurance activities with organizational risk and ensures comprehensive coverage.
:
The Institute of Internal Auditors (IIA) Practice Guide: Coordinating Risk Management and Assurance.
IIA Standard 2050 - Coordination and Reliance

According to the IIA's Implementation Guide for Standard 2340 - Engagement Supervision1, one of the activities that the chief audit executive or the designated engagement supervisor should perform is to review and approve the engagement work program before the commencement of fieldwork. The engagement work program should be based on the engagement objectives, scope, and approach, and should reflect the risks and controls identified during the planning phase. The engagement work program should also be discussed with the engagement team to ensure that they understand the tasks and procedures to be performed, and to address any questions or concerns. The engagement supervisor should document the approval of the work program and any subsequent changes in the workpapers.

* A. Information obtained from historic audits and memos:Useful for context but not typically part of the formal work program.
* B. Risk and control registers or matrices:Used in the planning phase but not part of the detailed execution in the work program.
* C. Resource deployment plans and sampling methodologies:Correct. These are essential components of the work program, guiding audit execution and resource allocation.
* D. Prior findings and management responses:Inform planning but do not typically appear in the work program itself.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Engagement Work Program.