Reperformance is a CAATs approach that involves independently executing the same procedures as the original process to verify the accuracy of the application's calculations. This approach maximizes the use of CAATs because it directly tests the functionality and reliability of the system by ensuring that the system processes transactions and calculations correctly, as intended by management.
IIA References:
* IIA Standard 1220: Due Professional Care suggests that internal auditors should apply appropriate techniques, such as CAATs, to obtain sufficient evidence. Reperformance as a CAATs method is particularly effective in verifying the integrity of system calculations.
* The Practice Guide on Using CAATs highlights that reperformance is one of the most powerful techniques for validating that a system operates as intended and that transactions are processed correctly.

CSR Policy Development: In developing a Corporate Social Responsibility (CSR) policy, it is important that the principles of CSR are communicated and understood throughout the organization.
Integration into Decision-Making: Management's responsibility includes ensuring that CSR principles are not only communicated but also integrated into the organization's decision-making processes at all levels. This ensures that CSR is part of the organizational culture and operational strategies.
Board's Role: While the board has a role in overseeing and ensuring that CSR objectives are established and risks are managed, the day-to-day responsibility for integrating CSR into business operations lies with management.
IIA Guidance: According to IIA guidance, internal auditors should evaluate the design, implementation, and effectiveness of the organization's ethics-related objectives, programs, and activities, which include CSR initiatives (Standard 2110 - Governance).
References:
* Effective communication and integration of CSR principles ensure that the organization operates in a socially responsible manner, aligning its business practices with societal expectations and contributing to sustainable development.

Managing Third-Party Risk: When a third party oversees the organization's network and data, the primary concern is to manage and mitigate risks associated with outsourcing critical functions.
Strong Contract Provisions: Drafting a strong contract that includes specific provisions such as regular vendor control reports and a right-to-audit clause is essential. These provisions ensure that the organization maintains oversight and control over the third party's activities.
IIA Standards: Standard 2201 - Planning Considerations requires that internal auditors consider the organization's objectives and the means by which they are achieved, including the role of third parties.
Contract Management:
* Control Reports: Regular control reports from the vendor provide insights into their performance and compliance with agreed-upon standards.
* Right-to-Audit Clause: This clause allows the organization to periodically audit the third party to ensure compliance with contractual obligations and to assess the effectiveness of their control environment.
References:
* Ensuring that third-party vendors adhere to the same standards of risk management and control as the organization helps in mitigating risks related to data security and network management.

According to IIA guidance, when assembling an engagement team to audit a vendor, it is crucial to include internal auditors who have expertise in investigating vendor fraud. This expertise is essential for identifying and assessing fraud risks associated with the vendor and ensuring a thorough and effective audit. While proficiency in financial statement analysis and local accounting principles is valuable, the specific context of vendor fraud requires specialized knowledge in that area.
IIA Standards: 1210.A2 - Proficiency
IIA Practice Guide: Auditing Third-Party Risk Management

To determine if loans were granted in accordance with the organization's policies, the most effective approach is to validate a sample of loans against the applicable underwriting guidelines. This method allows the auditor to directly assess compliance with the specific criteria set out in the organization's loan granting policies, providing clear evidence on whether the loans meet the required standards.
The Institute of Internal Auditors (IIA) Practice Guide: Auditing Credit Risk Management IIA Standard 2210 - Engagement Objectives