Including the annual impact of the changed agreement on cash flows in the observation provides a clear quantification of the financial effect of the policy violation. This information is critical for understanding the significance of the issue and for decision-making regarding corrective actions. It shows the long-term implications of the unauthorized contract change, which is essential for management and the board to assess the severity of the non-compliance and its impact on the organization's financial health.References:
* The Institute of Internal Auditors (IIA) - Practice Guide: Formulating and Expressing Internal Audit Opinions

The sections of the workpapers most likely to require changes after considering an important compensating control would include the effect of the control weakness, the conclusion on the control weakness, and the recommendation for the control weakness. The effect might be mitigated by the compensating control, leading to a different conclusion and potentially altering the recommendation.
IIA Reference:
IIA Standard 2310: Identifying Information requires that sufficient, reliable, relevant, and useful information must be obtained to support the engagement results. If a compensating control was not adequately considered, the conclusion and recommendations related to the control weakness might need to be revised to reflect a more accurate assessment.
The Practice Guide on Evaluating Internal Controls suggests that all relevant controls, including compensating controls, should be considered when forming conclusions and making recommendations.

Audit observations are structured around the 4Cs: Condition, Criteria, Cause, and Consequence.
* Criteria = what "should be."
* Condition = what "is."
* Cause = why the deviation occurred.
* Consequence = effect or risk.
In this case, the correct criteria is that each invoice should be recorded only once in the accounting system (Option A). Options B and C describe condition and consequence, while Option D is irrelevant.

Option C is correct. The engagement supervisor has identified a resource and competency limitation that may prevent the engagement team from adequately investigating a critical finding. The supervisor should therefore escalate the matter to the chief audit executive rather than independently deciding to outsource, abandon the work, or communicate prematurely with operational management. The Global Internal Audit Standards specifically state that when resource limitations interfere with the internal audit function ' s ability to achieve engagement objectives, the engagement supervisor is responsible for escalating the concern to the CAE. The CAE then determines the appropriate course of action and, when necessary, discusses the implications with senior management or the board. Option B may ultimately become the solution, but the supervisor does not bypass the CAE to make that decision. Option D would potentially leave a critical risk inadequately addressed.

According to the International Standards for the Professional Practice of Internal Auditing (Standards) set by the Institute of Internal Auditors (IIA), internal audit functions are allowed flexibility in including consulting engagements in their annual plans. Standard 2010 - Planning states that "the chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals." This risk-based plan should consider the potential value-add of consulting engagements.
Consulting engagements that are expected to add significant value or align with strategic objectives are often included, but not all requests need to be automatically included unless they meet these criteria.References:
* Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2010 - Planning.