A gap analysis is used to assess the completeness of sales invoices by identifying any missing records within a sequence. This technique helps in pinpointing any sales that might have been omitted or unrecorded during the invoicing process. By comparing expected sequences with actual recorded transactions, the auditor can identify discrepancies and ensure all sales are accounted for.
The Institute of Internal Auditors (IIA) Practice Guide: Data Analytics IIA Standard 2320 - Analysis and Evaluation

Comprehensive and Detailed Explanation:
Data privacy principles - particularly under GDPR and similar frameworks - emphasize data minimization, purpose limitation, and lawful processing. Once a customer closes an account and the statutory retention period ends, the organization should destroy personal information (A) to prevent misuse. Sharing data with affiliates (B) without explicit consent violates purpose limitation. Retaining data for convenience (C) is not legally justified. Using personal information for external research (D) is only valid if explicit consent was granted, but this is not described. Thus, the correct approach is Option A - delete data when it is no longer needed or legally required, ensuring compliance with privacy laws.

Management action plans should include, at a minimum, an owner of the action plan. The owner is responsible for ensuring that the action plan is implemented and for overseeing the corrective measures. This accountability is crucial for effective follow-up and resolution of audit findings.
IIA Standards: 2500 - Monitoring Progress
IIA Practice Guide: Follow-up Process in the Internal Audit Activity

When interviewing a fraud suspect, it is important to gather both subjective and objective information (Option
1). Subjective information can include opinions or perspectives, which may provide insights into motivations or behaviors, while objective information consists of factual data. The interviewer typically begins with open- ended questions (Option 3) to allow the suspect to provide information freely and without leading them to specific answers. The primary objective is to gather information rather than to obtain a written confession (Option 2), and video recordings, while beneficial in certain cases, are not always used and thus not a standard requirement (Option 4). References:
* The IIA's Practice Guide on Conducting Internal Audits in Conformance with the International Standards for the Professional Practice of Internal Auditing (Standards).
* The IIA's Practice Guide on Fraud Auditing and Investigation.

The chief audit executive (CAE) has the responsibility to provide assurance and insight on risk management processes. In a meeting with senior management to discuss significant risks, the CAE should focus on evaluating whether the risks accepted by senior management align with the organization's risk appetite and are within acceptable levels. The CAE should ensure that the risk management practices are adequate and that senior management is aware of any risks that might exceed the organization's tolerance levels. This approach is aligned with the role of internal audit in providing independent and objective evaluations.
Institute of Internal Auditors (IIA) Standards: Performance Standards 2120: Risk Management IIA Practice Guide: Assessing the Risk Management Process