An internal auditor and engagement client are deadlocked over the auditor's differing opinion with management on the adequacy of access controls for a major system. Which of the following strategies would be the most helpful in resolving this dispute?

In a review of an electronic data interchange application using a third-party service provider, the auditor should:
1. Ensure encryption keys meet International Organization for Standardization (ISO) standards.
2. Determine whether an independent review of the service provider's operation has been conducted.
3. Verify that only public-switched data networks are used by the service provider.
4. Verify that the service provider's contracts include necessary clauses, such as the right to audit.

An auditor for a major retail company suspects that inventory fraud is occurring at three stores which have high costs of goods sold. Which of the following audit activities would provide the most persuasive evidence that fraud is occurring?

Production managers for a manufacturing company are authorized to prepare emergency purchase orders for raw materials. These manually prepared orders do not go through the purchasing department and do not require a receiving report. The managers forward the invoice and purchase order to the accounting department for payment. Which of the following internal controls would efficiently prevent abuse of this system?

What is the primary factor that determines the depth and breadth of audit follow-up?