* Introduction:
* The independence and objectivity of the internal audit function are paramount, especially when the CAE has had prior involvement in the area under review.
* Scenario Analysis:
* Option A: Previous consulting assignments may raise concerns but do not inherently impair independence if managed correctly.
* Option B: A historical role in accounting functions is less problematic if sufficient time has passed and there is no ongoing influence.
* Option C: Having been the payroll manager presents a direct conflict of interest, compromising the CAE's objectivity.
* Option D: Reviews following consulting assignments are common practice and do not necessarily indicate a conflict.
* Conclusion:
* It is problematic for the CAE to provide assurance over payroll functions if they were previously the payroll manager, as this creates a clear conflict of interest and threatens audit objectivity.
IIA's International Standards for the Professional Practice of Internal Auditing, Standard 1130: Impairment to Independence or Objectivity.

Enhancing stakeholders' perception of the value added by the internal audit activity (IAA) involves demonstrating strong relationships with audit clients (Option 3) and participating in project teams and task forces in an advisory capacity (Option 4). These activities show the IAA's active involvement in the organization's operations and its commitment to adding value beyond traditional auditing roles. While the use of computer-assisted audit techniques (Option 1) and a consistent risk-based approach (Option 2) are important, they are more related to internal audit efficiency and effectiveness rather than directly enhancing stakeholder perception of value.
IIA Practice Guide on Demonstrating Value.
IIA Standard 2100: Nature of Work.

Comprehensive and Detailed Explanation:
Secondary controls are not primary risk mitigations but provide backup support if key controls fail. When preparing the work program, auditors generally focus on key controls, since they directly address significant risks. Secondary controls may not require testing unless they provide meaningful risk reduction where primary controls are weak or absent. Option A is inefficient; a separate work program for secondary controls is not required. Option C is incorrect - documentation alone does not make them essential. Option D is misleading because secondary controls are not subject to the same level of testing rigor as key controls.
Therefore, Option B is correct: secondary controls do not always need to be tested.

When a client decides not to implement recommended process improvements from a consulting engagement, the internal audit activity should confirm the decision with management and document it in the audit file. This approach ensures that the audit trail is complete and that there is a record of management's acceptance of the associated risks. Escalating the issue to the board (Option A) or initiating an assurance engagement (Option D) might be necessary if the risks are significant, but these actions are not the immediate next steps.
Continuous follow-up (Option C) is more relevant to assurance engagements rather than consulting engagements.
IIA Standard 2500: Monitoring Progress.
IIA Practice Guide on Consulting Engagements.

If senior management decides to accept risks, such as doing business with a questionable vendor, and the chief audit executive (CAE) believes this poses a significant risk to the organization, the CAE should escalate the issue to the board. The board has the ultimate responsibility for overseeing risk management and can decide on the appropriate action to take in response to the risk.
IIA References:
* IIA Standard 2600: Communicating the Acceptance of Risks states that when the CAE believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the CAE must discuss the matter with senior management. If the decision regarding risk remains unchanged, the CAE must inform the board.
* The Practice Guide on Risk Management highlights the importance of the CAE keeping the board informed of significant risks that management has chosen to accept, particularly when these risks could have a material impact on the organization.