* A. Review year-over-year trending of total dollars spent in each period:This is the correct approach because year-over-year analysis focuses on identifying anomalies or significant variances in expenses over time. Trends in data can help detect unexpected spikes, dips, or patterns that indicate irregularities or inefficiencies. This aligns with analytical procedures in expense analysis under the CIA Exam Syllabus Part 2, which emphasizes the use of comparative techniques to evaluate reasonableness.
* B. Review changes to the vendor master file for suspicious activity:While reviewing vendor master file changes is essential for fraud detection and control testing, it does not directly help in determining the reasonableness of monthly expenses.
* C. Review the percentage of on-time payments against prior periods:Examining payment timeliness relates to operational efficiency and cash flow management, not directly to evaluating whether monthly expenses are reasonable.
* D. Review total expenses for accounting against other department expenses in the organization:
Comparing accounting department expenses to those of other departments might indicate disparities but does not consider differences in department-specific activities and needs.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Analytical Procedures and Testing Methods.

When conducting a review of an electronic data interchange (EDI) application provided by a third-party service, the internal auditor should ensure several key aspects to maintain security and compliance:
* Independent Review of Service Provider: Determine whether an independent review of the service provider's operations has been conducted. This review helps ensure that the service provider meets necessary standards and maintains adequate controls.
* Contractual Clauses: Verify that the service provider's contracts include necessary clauses. These clauses should cover aspects like data security, confidentiality, compliance with standards, and performance metrics.
Ensuring encryption keys meet ISO standards and verifying the use of public-switched data networks are important but are more specific technical controls that might be part of broader reviews. The focus here should be on independent verification and robust contractual agreements

To address the risk of fraud in the cash receipts process, it is essential to ensure that the accounts payable department reconciles all purchasing documents (purchase requisitions, purchase orders, packing slips, and invoices) before making payments. This step helps to detect discrepancies and prevent fraudulent activities, ensuring that payments are made only for legitimate and verified transactions. References:
* IIA Standards - 1220: Due Professional Care
* IIA Practice Guide - Auditing Accounts Payable: Reducing the Risk of Fraud

Detective controls are designed to identify and detect errors or fraud after they have occurred. Receipts for employee expenses serve as a detective control by providing evidence of transactions, enabling verification and review of expenses to identify any fraudulent or unauthorized activities. Awareness of prior incidents of fraud (Option A) is more of a preventive control, contractor non-disclosure agreements (Option B) are preventive controls to mitigate risks of information leakage, and verification of currency exchange rates (Option C) is more of a transaction control. References: IIA Glossary - Detective Controls, COSO Framework

According to the IIA guidance, when reviewing an organizational process, the engagement work test typically focuses on process controls. This involves evaluating the design and effectiveness of controls in place to mitigate identified risks and ensure the achievement of process objectives. Assessing process controls helps auditors determine if the controls are operating as intended and are sufficient to manage the associated risks.
References:
* The Institute of Internal Auditors (IIA) Standards
* Internal Audit Engagement Planning and Execution