A risk and control questionnaire (RCQ) is used during preliminary surveys to help the auditor ascertain the existence of controls in a specific process or program. It provides structured information about which controls are in place, which are missing, and how they are applied.
Option A refers to reconciliation, which is not the main purpose. Option C (testimonial information) suggests reliance on management statements, which is weaker than structured control identification. Option D involves external confirmation, which goes beyond the RCQ's purpose.
Reference:
IIA Practice Guide - Engagement Planning: Preliminary Survey and Risk Assessment.

Diagnostic analytics is used to understand why something happened. In this scenario, the internal auditor has already identified an anomaly: a significant drop in accounts payable volume. The auditor then creates scenarios to explain the possible causes of that anomaly, which is diagnostic analysis. Descriptive analytics summarizes what happened, such as reporting the volume decline. Predictive analytics estimates what is likely to happen in the future. Prescriptive analytics recommends actions based on expected outcomes or optimization. Internal auditors use diagnostic analysis to investigate variances, exceptions, unusual patterns, control failures, and root causes. Since the auditor is trying to explain the cause of the accounts payable change, Option B is correct.

If the internal audit activity lacks the necessary skills to perform certain audits, this represents a limitation that could impair internal audit's ability to meet its responsibilities. The CAE must report such resource or competency limitations to the board.
Options A, B, and D (procedures, forms, or methods) may be adjusted internally, but they do not rise to the level of a significant limitation requiring board reporting. Skills gaps, however, directly impact audit coverage and effectiveness.
Reference:
IIA Standards - Standard 2030: Resource Management; Standard 2060: Reporting to Senior Management and the Board.

Reference: IIA Business Knowledge for Internal Auditing, Performance Management section.

Capacity overbuilding is most likely when management is production-focused. Production-oriented managers may emphasize scale, output, plant utilization, and operational expansion, sometimes without sufficient demand analysis. This can result in excess facilities, idle capacity, high fixed costs, inventory buildup, and reduced profitability. A marketing focus would normally begin with customer demand and market opportunity. A finance focus would emphasize return on investment, capital discipline, and cash flow.
Diversification may create strategic risk, but it does not directly drive overbuilding in the same way as production orientation. Internal audit should evaluate whether capacity investments are supported by reliable forecasts, approved capital budgeting, sensitivity analysis, and post-implementation reviews. Therefore, Option C is correct.