An auditor completes testing for a risk and its related control but records the supporting test detail only as a narrative comment, without a workpaper reference linking the risk and control documentation to the underlying test and finding workpapers. Under Standard 14.6, why is this documentation practice inadequate?

The audit team has access to the complete population of loan originations for the audit period through a data extraction tool. Rather than testing all originations for override-approval compliance, the team selects a sample of 40 files using traditional attribute sampling. Which statement BEST evaluates this choice against Standard 14.1?

The audit team writes in its follow-up tracking documentation: “Since management already monitors override rates monthly, internal audit does not need its own continuous-auditing indicator for this area.” What is the flaw in this reasoning?

An auditor writes: “The root cause is that the compliance analyst forgot to run the monthly override report.” Applying Paterson’s root cause discipline, why is this an inadequate root cause statement?

Internal audit’s testing finds that a vendor patch management policy, the design, requires critical patches within 30 days, and sampled evidence shows the population was patched within 30 days in 9 of 10 instances, with the tenth patched on day 34 due to a vendor delay outside the company’s control. What is the MOST defensible operating effectiveness conclusion?

Follow-up tracking documentation proposes tracking “model-drift and fair-lending outcome metrics, refreshed monthly” as an ongoing internal audit activity between engagements. Which distinction MOST accurately classifies this proposal?

An audit report’s executive summary opens with three paragraphs praising the department’s cooperation before mentioning, in the final paragraph, that a High significance finding exists. What judgment problem does this structure MOST likely reflect?

An engagement report is issued on time, is well written, and clearly rated. Six months later, no one on the audit team has checked whether the recommended corrective action plans have been implemented. Which standard has been left unmet?

A corrective action plan’s target date passes with no visible progress and no explanation from management. What does Standard 15.2 require the internal auditor to do next, and who ultimately decides what the inaction means?

The audit team is testing whether overrides on consumer loan underwriting are reviewed monthly. The population is 1,200 override transactions for the year. The team selects a haphazard sample of 8 transactions from the most recent month only and concludes overrides are adequately reviewed throughout the year. Which deficiency MOST directly undermines the sufficiency of this evidence under Standard 14.1?