An internal auditor is planning a business continuity audit engagement at a remote manufacturing plant. During planning interviews, the plant manager stated that the local Environmental, Health, and Safety (EHS) Department, which reports to the plant manager, had completed a similar review six months ago. The EHS review did not find any significant weaknesses. How should the internal auditor consider the EHS review results in the current audit engagement planning?

• A. Ignore the EHS review results, as the department is not a reliable source of information due to its lack of objectivity and independence.
• B. Evaluate the objectivity and competency of the EHS reviewers and their work to determine whether their review results may be relied upon.
• C. Recommend canceling the audit engagement, as it would be a duplication of effort to revisit the same process already reviewed by EHS.

Which of the following would be the best indicator that the organization's risk management processes are operating effectively?

• A. Management openly discusses both risks and opportunities facing the organization.
• B. The organization implemented formal operational risk management processes.
• C. Management established policies and procedures that state risk will be considered.

Management requested that the chief audit executive (CAE) include an audit of the organization's health and safety program in next year's annual audit plan. However, the internal audit activity has no expertise in this area. Which of the following would be the most appropriate actions for the CAE?

• A. Work with an internal subject matter expert to complete the audit.
• B. With management's agreement, amend the audit scope so that specialized expertise is not needed.
• C. Accept the request, provided management has conducted a thorough risk assessment prior to the engagement to help guide the audit.

Operational management has asked the internal auditor for recommendations regarding an ineffective process. According to IIA guidance, which of the following would be the auditor's most appropriate response?

• A. Explain that only management should recommend and implement the corrective action.
• B. Refrain from providing recommendations to preserve audit independence.
• C. Agree to offer recommendations based on observations and conclusions.

Which of the following conditions involving the chief audit executive (CAE) is most likely to impair the independence of the internal audit activity?

• A. The CAE regularly attends and participates in critical executive management meetings for the organization.
• B. The CAE has direct access to records, personnel, and physical properties throughout the organization.
• C. The CAE reports directly to the controller for the organization, and the internal audit activity resides in the office of the comptroller.