Effective risk management and internal control processes are best exemplified by having relevant risk indicators and mitigation plans in place. This demonstrates that the organization not only identifies and assesses risks but also actively monitors and manages these risks through appropriate mitigation strategies.
The presence of risk indicators and mitigation plans indicates a proactive approach to risk management, ensuring that potential issues are addressed before they can impact the organization significantly.
References:
* The Institute of Internal Auditors (IIA) Standard 2100 - Nature of Work: "The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach."
* COSO Enterprise Risk Management Framework

According to IIA guidance on due professional care, internal auditors should perform thorough and adequate steps to verify the accuracy and legitimacy of transactions. When reviewing cash disbursements, it is essential to check the three-way match among the invoice, purchase order, and receiving report. This ensures that the payment is valid, authorized, and that the goods or services were actually received as ordered. This step is crucial in preventing and detecting errors and fraud, thereby ensuring that the audit findings are reliable and accurate.References:
* IIA Standard 1220: Due Professional Care
* IIA Practice Guide: Auditing Accounts Payable and Disbursements