According to IIA guidance, the focus of a review of controls to prevent fraud should be on the effectiveness rather than the efficiency of the controls. Effectiveness pertains to whether the controls adequately mitigate fraud risks and prevent fraudulent activities, while efficiency focuses on the performance and cost- effectiveness of the controls, which is not the primary concern in preventing fraud. This makes statement A false in the context of IIA guidance.
IIA Standards: 1220.A1 - Due Professional Care
IIA Practice Guide: Fraud Prevention and Detection in an Automated World

External benchmarking using trend analysis involves comparing a company's performance metrics with industry standards or averages over a certain period to identify trends and areas for improvement. Comparing common-size financial statements of the subsidiary with the averages of the industry for the last two periods allows for a normalized comparison by expressing financial statement items as a percentage of a common base figure (e.g., total assets or sales). This method highlights the subsidiary's financial structure and performance trends in relation to industry norms, facilitating a comprehensive analysis. References:
* "Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)
* "Benchmarking: An Essential Tool for Assessment, Improvement, and Market Leadership" (Michael J.
Spendolini)

For compliance engagements, particularly those related to critical processes such as cash disbursements, it is important to distribute the final audit report to individuals with oversight and decision-making responsibilities. The accounts payable manager oversees the process, the chief financial officer (CFO) has overall financial oversight, and the audit committee provides governance and oversight of the audit function.
This ensures that the report is reviewed by those with the authority to implement changes and address any issues identified. References:
* IIA Standards - 2440: Disseminating Results
* IIA Practice Advisory - 2440-1: Disseminating Results

* A. Information obtained from historic audits and memos:Useful for context but not typically part of the formal work program.
* B. Risk and control registers or matrices:Used in the planning phase but not part of the detailed execution in the work program.
* C. Resource deployment plans and sampling methodologies:Correct. These are essential components of the work program, guiding audit execution and resource allocation.
* D. Prior findings and management responses:Inform planning but do not typically appear in the work program itself.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Engagement Work Program.

If operational management has not implemented effective actions to address a significant control breach, the most appropriate next step for the chief audit executive is to discuss the matter with senior management. This step involves escalating the issue to a higher level of authority to ensure that the risks associated with the control breach are properly understood and addressed. If senior management fails to take appropriate action, the CAE may then escalate the issue to the board.
IIA Standard 2500: Monitoring Progress
IIA Practice Guide: Auditing Organizational Governance