For a one-person audit function, the primary focus is on ensuring that there is a clear understanding of the audit policies and procedures without the need for extensive documentation. According to the IIA's guidance, a memorandum stating the policies and procedures would suffice for a one-person audit function, providing a concise yet comprehensive outline of the necessary protocols to follow. This approach ensures that the sole auditor has clear directives while avoiding the administrative burden of maintaining a more extensive manual that might be necessary for larger audit teams.
The Institute of Internal Auditors (IIA) - Practice Advisory 2040-1: Policies and Procedures

According to IIA guidance, the primary purpose of the exit conference is to ensure timely communication of observations and findings, especially those that require immediate management action. This meeting allows auditors to discuss their findings with management, address any disagreements, and clarify the facts before the final report is issued. It does not require the attendance of both the chief audit executive and the chief executive over the activity (B), nor is it solely for reviewing anticipated results (C) or the performance of the internal auditors (D). References: IIA Standard 2440 - Disseminating Results, IIA Practice Advisory 2440-1

* Stratification groups numeric values into categories.
* Gap testing identifies missing values in sequences.
* Duplicate testing identifies repeated identical entries within a dataset.
* Joining different data sources allows matching of information across disparate systems (e.g., comparing vendor names in accounts payable vs. vendor master records).
Since the question refers to identifying inconsistencies across different systems, the correct technique is joining different data sources (Option C).

A consulting engagement in internal auditing involves providing advisory and related client service activities, the nature and scope of which are agreed upon with the client. These are intended to add value and improve an organization's governance, risk management, and control processes. Helping in the design of the risk management program is a consulting activity because it involves advising management on how to establish or improve the processes for identifying, assessing, and managing risks. This is different from assurance engagements, which primarily focus on assessing existing processes.
The Institute of Internal Auditors (IIA) Standard 2010: Planning
IIA Practice Advisory 2010-1: Linking the Audit Plan to Risk and Exposures

* Identifying the Anomaly: The internal auditor has identified a discrepancy in the travel expenses of the department head, who frequently travels yet reports minimal expenses. This raises a red flag that needs further investigation.
* Understanding the Context: It is important to determine if there are legitimate reasons for the discrepancy, such as special arrangements made for senior management travel, which could explain the absence of typical travel expenses like hotels, meals, and transportation.
* Appropriate Next Step: Investigating whether there are any special arrangements for senior management travel (Option C) is the most logical next step. This helps in understanding the context and validating whether the discrepancy is justified or indicative of potential issues such as fraud or misreporting.
Reference: Internal auditing standards emphasize the need for auditors to understand the environment and context of the organization's operations when anomalies are detected.
Other Options Considered:
Option A: Making a note for future follow-up is not proactive and delays addressing a potential issue.
Option B: Analyzing supplier trends, while useful, does not directly address the travel expense anomaly.
Option D: Estimating costs based on destinations can provide insights but does not explain potential legitimate arrangements made by the organization.
Conclusion: Investigating special arrangements regarding senior management travel (Option C) is the most appropriate step to understand the discrepancy and ensure there are no irregularities.