Section: Volume A

The IIA recognizes that internal auditors can provide valuable consulting services that support the organization's risk management without compromising their independence. Facilitating risk assessment workshops (option B) is a consulting service that internal auditors can perform, which helps the organization identify and evaluate risks in a structured way. This activity does not involve making management decisions or assuming management responsibilities, preserving the internal audit's advisory role.References:
* IIA Standard 1000: "Consulting Services"

1. A control is effective when it achieves its intended objective, such as preventing or detecting errors or fraud. A control is efficient when it minimizes the cost and effort required to achieve its objective
2. In this case, the control of automatically creating amended purchase orders is effective because it ensures that the discrepancies between the original purchase order and the final invoice are resolved. However, the control is inefficient because it generates too many amended purchase orders for minor differences that may not be material or significant. This may result in unnecessary administrative burden, delays, and waste of resources
3. A more efficient control would be to set a threshold or tolerance level for the discrepancies and only create amended purchase orders when the difference exceeds that level
4. Internal audit requests access to write and export specialized reports from the organization's database to aid with testing and analysis.