When using the balanced scorecard approach to assess the performance of the internal audit activity, a key performance indicator relevant to the audit client is the percentage of recommendations implemented by the corrective action date. This KPI measures the effectiveness and impact of the audit activity by tracking how well the audit recommendations are being acted upon within the agreed-upon timeframe. It reflects the responsiveness and commitment of the organization to address identified issues and improve its control environment, which is directly relevant to the interests and concerns of the audit clients.
The Institute of Internal Auditors (IIA) Practice Guide: "Measuring Internal Audit Performance" Kaplan, R.S. & Norton, D.P. (1996). "The Balanced Scorecard: Translating Strategy into Action"

According to IIA guidance, the internal audit plan should be based on an assessment of risks to the organization (1), designed to determine the effectiveness of the organization's risk management process (2), and aligned with the organization's goals (4). The development of the audit plan is typically the responsibility of the chief audit executive, often with input from senior management and the audit committee, rather than being solely developed by senior management (3). References: IIA Standard 2010 - Planning, IIA Practice Guide - Developing the Internal Audit Plan

According to IIA guidance, the CAE has the ultimate responsibility for the internal audit activity but may delegate tasks such as reviewing, approving, and signing engagement reports to qualified internal audit staff.
This delegation helps in managing workload and leveraging expertise within the team. However, the CAE should still periodically review the reports to maintain oversight and ensure quality. References: = IIA Standard 2060 - Reporting to Senior Management and the Board, and Standard 2400 - Communicating Results.

Internal control questionnaires are an efficient information-gathering method for an internal auditor to determine whether specified control procedures are in place. These questionnaires are designed to capture detailed information about controls through structured questions, enabling auditors to quickly identify the existence and nature of controls. This method is systematic and allows for comprehensive coverage of various control aspects, making it efficient for initial assessments.
:
IIA Standard 2240: Engagement Work Program
IIA Practice Guide: Using Control Self-Assessment for Continuous Improvement

The appropriate conclusion that can be drawn from the findings is that the internal controls guiding contract management are not operating effectively. The listed findings, such as noncompliance with contract provisions, lack of monitoring compliance with contract obligations and deliverables, and absence of contract agreements with key vendors, indicate significant control deficiencies in the contract management process. These deficiencies suggest that the controls intended to ensure compliance and effective management of contracts are either inadequate or not functioning as intended.
Reference: IIA's Guide on Internal Controls and Audit Findings.