According to IIA guidance, when assembling an engagement team to audit a vendor, it is crucial to include internal auditors who have expertise in investigating vendor fraud. This expertise is essential for identifying and assessing fraud risks associated with the vendor and ensuring a thorough and effective audit. While proficiency in financial statement analysis and local accounting principles is valuable, the specific context of vendor fraud requires specialized knowledge in that area.
:
IIA Standards: 1210.A2 - Proficiency
IIA Practice Guide: Auditing Third-Party Risk Management

The primary reason for an internal auditor to use a risk and control questionnaire when auditing financial processes is to gain an understanding of the control environment. These questionnaires help auditors identify and evaluate the presence and effectiveness of controls within the financial processes. They provide a structured way to gather information about the control environment, helping auditors understand the organization's risk management and control practices before conducting detailed testing.
References:
* IIA Standards: 2201 - Planning Considerations
* IIA Practice Guide: Internal Auditing and Fraud

Comprehensive and Detailed Explanation:
Software development security requires internal auditors to understand change management processes (B)
- how updates, patches, and new code are introduced and controlled to prevent vulnerabilities. While IT general controls (A) are important, they are broader (e.g., access, backup, operations). Fluency in programming languages (D) and proficiency in design software (C) are too technical and unnecessary for audit. Instead, auditors need to understand how changes are authorized, tested, and implemented, ensuring that the development process follows security and governance standards. According to Standard 1210 - Proficiency, internal auditors must have or obtain sufficient knowledge to evaluate relevant risks, making change management competency most critical.

A scatter diagram plots two variables on a graph to examine whether there is a correlation or relationship.
Here, electricity price and wind speed can be plotted to test if changes in one relate to changes in the other.
* A Gantt chart (A) is for project scheduling.
* A RACI chart (C) clarifies roles and responsibilities.
* A SIPOC diagram (D) maps processes.
Therefore, the best analytical tool for correlation analysis is the scatter diagram.