Which sampling plan requires no additional sampling once the first error is found?

According to the International Professional Practices Framework, the internal audit activity's decision to defer follow-up of recommendations and management's corrective actions until the next scheduled engagement for the area is justified when:

Due to the expanded role of internal audit in the organization, the chief audit executive (CAE) of a construction company decides to employ the services of an outsourced audit service provider to augment the internal audit staff. What does the CAE need to consider in determining whether the outsourced audit service provider possesses the necessary knowledge, skills and other competencies to perform an audit engagement?

----
Which of the following is correct with respect to roles within an enterprise-wide risk management process?
The board provides oversight to the risk management process.
Executive management owns the risk management framework.
Senior management is assigned ownership of risks.
Internal audit modifies the risk assessment determined by management.

According to IIA guidance, which of the following are acceptable strategies for an internal audit activity (IAA) to establish or build relationships?