A due diligence engagement is the most appropriate type of engagement for assessing the maturity and rigor of the organization-wide risk management process of a target entity that management is considering acquiring. Due diligence involves a comprehensive appraisal of a business undertaken by a prospective buyer, especially to establish its assets and liabilities and evaluate its commercial potential. It typically includes evaluating financials, operational processes, and risk management frameworks to ensure informed decision- making about the acquisition.
:
The Institute of Internal Auditors (IIA), Practice Guide on Due Diligence
"Mergers and Acquisitions: A Step-by-Step Legal and Practical Guide" by Edwin L. Miller, Jr.

During the planning stage of an assurance engagement, internal auditors should focus their attention on identifying and assessing inherent risks. Inherent risk is the risk of a material misstatement or noncompliance due to error or fraud that could occur before any controls are applied. Understanding inherent risk is crucial as it helps auditors identify areas that may need more extensive testing and ensures that audit resources are appropriately allocated to the highest risk areas.
:
The Institute of Internal Auditors (IIA) Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000 IIA Standard 2010 - Planning

In the five-attribute approach to documenting deficiencies, the attribute that answers the question "What should be in place?" is Criteria. Criteria represent the standards, measures, or expectations used in making an evaluation and/or verification (what should be). It defines what the process or control should achieve, serving as a benchmark against which the actual condition (what is) is compared. The criteria are essential for identifying deviations and determining the nature and significance of deficiencies.
IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2410 - Criteria for Communicating.

The most reliable source of testimonial evidence regarding whether a process is effectively performed according to its design would be the supervisor in charge of the process. This is because supervisors are typically responsible for overseeing the day-to-day operations and ensuring that processes are followed correctly. They have a comprehensive understanding of the process and can provide valuable insights into its effectiveness and adherence to design. The reliability of evidence increases with the proximity of the individual to the process in question and their role in ensuring compliance and performance.
IIA's Global Technology Audit Guide (GTAG) - Testimonial Evidence.

Nonsampling risk refers to the risk that the auditor reaches an incorrect conclusion due to errors not related to the sample itself but to other factors such as misinterpretation of data, incorrect application of procedures, or human error.
* IIA Practice Advisory 2320-3:
* This advisory explains that nonsampling risk occurs when an auditor misinterprets results or applies the wrong audit procedure. It differs from sampling risk, which is the risk that a sample is not representative of the population.
* Misinterpretation of Sampling Results:
* In this case, the senior IT auditor misinterprets the sampling results during the audit of inventory valuation. This is a classic example of nonsampling risk, where the error is due to the auditor's misunderstanding or misapplication of the data, rather than an issue with the sampling process itself.
* IIA Standard 2320 - Analysis and Evaluation:
* This standard requires that auditors apply sufficient care and skill in analyzing and interpreting audit evidence. Nonsampling risk can occur if this standard is not met, resulting in incorrect conclusions.
* Option A (Sampling risk): This refers to the risk that the sample does not accurately represent the population, which is not the issue here.
* Option B (Control risk): This refers to the risk that a control will fail to prevent or detect errors or fraud, unrelated to this situation.
* Option D (Residual risk): This refers to the risk that remains after controls are implemented, also unrelated to this scenario.
Detailed Explanation:Why Not Other Options?Conclusion: Option C is correct as it accurately describes the situation where the auditor misinterprets the sampling results, which is a form of nonsampling risk, according to IIA guidance.