Which of the following factors would not be considered in determining appropriate follow-up procedures?

An auditor analyzed a payroll system's data files for unusual activity, such as excessive overtime hours, unusual fluctuations in pay rates, and excessive vacation time. The application controls being verified by this analysis are:

An internal auditor would most likely use attributes sampling when testing which of the following?

An internal auditor is assigned to conduct an audit of security for a local area network (LAN) in the finance department of the organization. Investment decisions, including the use of hedging strategies and financial derivatives, use data and financial models which run on the LAN. The LAN is also used to download data from the mainframe to assist in decisions. Which of the following should be considered outside the scope of this security audit engagement?

The board has asked the internal audit activity (IAA) to be involved in the organization's enterprise risk management process. Which of the following activities is appropriate for IAA to perform without safeguards?