Nonstatistical sampling allows auditors to use their professional judgment to determine the sample size and select the items to be tested. Unlike statistical sampling, which relies on probabilistic methods to determine the sample size and selection, nonstatistical sampling is more flexible and can be tailored to the specific circumstances of the audit engagement.
IIA References:
* IIA Standard 2320: Analysis and Evaluation suggests that internal auditors should apply appropriate methods to analyze data and draw conclusions. Nonstatistical sampling allows for the application of professional judgment, which can be advantageous in certain audit situations where rigid statistical methods may not be practical or necessary.
* The Practice Guide on Sampling discusses the differences between statistical and nonstatistical sampling, highlighting that nonstatistical sampling relies more on the auditor's judgment, which can be beneficial in certain contexts.
Given this, the correct answer is C. Nonstatistical sampling provides for the use of subjective judgment in determining the sample size.

Implementing environmental and social safeguards aligns with the broader organizational goal of achieving sustainable development.
These safeguards ensure that the organization operates in a manner that is environmentally responsible and socially conscious, which is crucial for long-term sustainability

The step that would accomplish the objective of testing management's identification and prioritization of critical data collected by the organization is to document and test a data inventory and classification program by determining the data classification levels and framework. This involves verifying that management has established a comprehensive data inventory and that data classification processes are in place and effectively implemented. It ensures that data is appropriately categorized based on its criticality and sensitivity, aligning with the organization's risk management framework and data governance policies.
IIA's Global Technology Audit Guide (GTAG) on Data Privacy and Protection, which outlines best practices for data classification and management.

According to ISO 31000, the risk management framework is scalable and applicable to organizations of all sizes, including small entities. The framework's principles are designed to be flexible and adaptable, ensuring they can be effectively implemented regardless of the organization's size.
* Scalability: The principles and guidelines of ISO 31000 can be tailored to fit the specific context, resources, and complexity of any organization, making it a universal standard.
* Flexibility: The framework supports organizations in integrating risk management practices into their operations at a level that suits their size and complexity.
* Effectiveness: Regardless of the organization's size, the framework aims to enhance risk management practices and support better decision-making.
References:
"ISO 31000: Risk Management Guidelines," which outlines the applicability and flexibility of the framework for all organizations .

Directive controls are designed to encourage desired behavior or outcomes.
* Option A: Segregation of duties is a preventive control, not a directive control.
* Option B: Exception reports are detective controls.
* Option D: Supervisory review is also a preventive or detective control.
* Option C: Training programs are directive controls as they guide employees on the correct procedures and practices to follow.