According to MA (Management Accounting) guidance and internal auditing standards, when assessing the likelihood of fraud risk, internal auditors should consider historical data and patterns within the organization.
Past fraud allegations and actual occurrences provide valuable insights into potential vulnerabilities and areas where controls might have previously failed. This historical perspective helps in evaluating the current fraud risk environment and in identifying areas that require stronger controls or more vigilant monitoring.
IIA Practice Guide: "Assessing the Risk of Fraud"
COSO (Committee of Sponsoring Organizations of the Treadway Commission) Fraud Risk Management Guide

According to the International Standards for the Professional Practice of Internal Auditing (Standards) set by the Institute of Internal Auditors (IIA), internal audit functions are allowed flexibility in including consulting engagements in their annual plans. Standard 2010 - Planning states that "the chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals." This risk-based plan should consider the potential value-add of consulting engagements. Consulting engagements that are expected to add significant value or align with strategic objectives are often included, but not all requests need to be automatically included unless they meet these criteria.
Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2010 - Planning.

When concerned about whether a transaction is recorded in the correct period, the internal auditor should consult accounting principles, standards, and relevant guidelines to determine the appropriate timing of the entry. External auditor approval does not negate the internal auditor's responsibility to ensure that the transaction complies with established accounting standards and principles. Consulting the relevant guidelines provides an objective basis for assessing the accuracy of the transaction's recording.
The Institute of Internal Auditors (IIA) Standard 1220 - Due Professional Care: "Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor." Generally Accepted Accounting Principles (GAAP) or International Financial Reporting Standards (IFRS) depending on the applicable framework.

* Introduction:
* When performing audit testing, internal auditors must consider the risk that their sample may lead to incorrect conclusions about the accuracy of account balances.
* Understanding Incorrect Acceptance Risk:
* This risk refers to the possibility that the sample used might support the conclusion that the recorded account balance is not materially misstated when, in fact, it is. This is a type of sampling risk that auditors need to mitigate through proper sampling techniques and sufficient sample sizes.
* Options Analysis:
* Option A: Incorrect rejection risk is the risk that the sample leads to the conclusion that the account balance is materially misstated when it is not.
* Option B: Incorrect acceptance risk directly addresses the concern described, where the sample fails to detect a material misstatement.
* Option C: Tolerable misstatement risk relates to the maximum error in a population that the auditor is willing to accept.
* Option D: Anticipated misstatement risk is not a standard audit term and does not describe the risk in question.
* Conclusion:
* The auditor's concern best describes the incorrect acceptance risk, which is the risk of concluding that the account balance is accurate based on a sample when it is actually misstated.
Internal Audit Standards and Practice Guides .

The CIA Exam (Part 2 - Practice of Internal Auditing) requires auditors to identify the root causes of issues and deviations from criteria, not just report symptoms. A root cause analysis seeks the underlying reason for a problem, rather than describing its occurrence.
* Option A simply describes the condition (missing results).
* Option B identifies a trend but not the underlying cause.
* Option D shifts responsibility to employees without addressing why results were not saved.
* Option C identifies a system design flaw that prevents employees from saving results, which is a true root cause.
Therefore, including Option C in the audit report demonstrates compliance with internal audit methodology, as it highlights the underlying systemic problem instead of merely documenting symptoms or assigning blame.