When interviewing a fraud suspect, it is important to gather both subjective and objective information (Option 1). Subjective information can include opinions or perspectives, which may provide insights into motivations or behaviors, while objective information consists of factual data. The interviewer typically begins with open-ended questions (Option 3) to allow the suspect to provide information freely and without leading them to specific answers. The primary objective is to gather information rather than to obtain a written confession (Option 2), and video recordings, while beneficial in certain cases, are not always used and thus not a standard requirement (Option 4). Reference:
The IIA's Practice Guide on Conducting Internal Audits in Conformance with the International Standards for the Professional Practice of Internal Auditing (Standards).
The IIA's Practice Guide on Fraud Auditing and Investigation.

When using the balanced scorecard approach to assess the performance of the internal audit activity, a key performance indicator relevant to the audit client is the percentage of recommendations implemented by the corrective action date. This KPI measures the effectiveness and impact of the audit activity by tracking how well the audit recommendations are being acted upon within the agreed-upon timeframe. It reflects the responsiveness and commitment of the organization to address identified issues and improve its control environment, which is directly relevant to the interests and concerns of the audit clients.
:
The Institute of Internal Auditors (IIA) Practice Guide: "Measuring Internal Audit Performance" Kaplan, R.S. & Norton, D.P. (1996). "The Balanced Scorecard: Translating Strategy into Action"

According to the International Standards for the Professional Practice of Internal Auditing, the CAE must be kept informed of significant issues and deficiencies that are not addressed by management. Standard 2600 - Communicating the Acceptance of Risks requires the CAE to report any situation where management has accepted a level of risk that may be unacceptable to the organization. If the engagement supervisor learns that agreed-upon remedial actions have not been implemented, the CAE needs to be notified to determine further steps, ensuring that risks are managed appropriately and in alignment with the organization's risk tolerance.
This response aligns with the internal audit function's responsibility to follow up on management's corrective actions.References: The IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2600 - Communicating the Acceptance of Risks.

A key planning step for internal auditors to establish appropriate engagement objectives is to evaluate management's risk assessment and the internal audit activity's risk assessment. This step ensures that the audit focuses on areas of highest risk and aligns with the organization's risk management framework. By understanding and incorporating the organization's risk priorities, the internal auditors can design their engagements to provide maximum value and assurance regarding the control environment and risk management processes.
The Institute of Internal Auditors (IIA) Standard 2010: Planning
IIA Practice Advisory 2010-2: Using the Risk Management Process in Internal Audit Planning