Which of the following is not likely to be included as an audit step when assessing vendor performance policies?

Which of the following conditions should a chief audit executive take into account when deciding if a follow-up audit engagement is necessary?
* The reported observations were significant and high risk.
* Internal audit resources and the time it will require for follow-up.
* Management may not have the resources to take action.
* Management has previously decided not to take any action.

In evaluating the validity of different types of audit evidence, which of the following conclusions is not correct?

Which of the following performance criteria would be most useful when measuring the performance of a customer service desk?

A chief audit executive (CAE) of a major retailer has engaged an independent firm of information security specialists to perform specialized internal audit activities. The CAE can rely on the specialists' work only if it is: