Section: Volume E

When developing the scope of an audit engagement, the internal auditor typically considers factors that directly impact the audit's objectives, risks, and execution. This includes the potential impact of key risks (Option B), the expected outcomes and deliverables (Option C), and the operational and geographic boundaries (Option D). While the need and availability of automated support (Option A) may be a practical consideration for how the audit is conducted, it is not fundamental to defining the scope of the audit engagement itself. The scope is primarily concerned with what is to be audited and why, rather than how the audit will be performed.
:
IIA Standard 2200: Engagement Planning.
IIA Practice Guide on Audit Engagement Planning.

Section: Volume C
Explanation/Reference:

Verification of Controls: The auditor should verify that the new IT system addresses the previously identified risks. This involves reviewing the system documentation and ensuring that the controls in the new system effectively mitigate the risks.
IIA Standard 2500 - Monitoring Progress, which emphasizes the need for auditors to follow up on management's corrective actions.
Reporting: Once the auditor has confirmed that the new system controls address the risks, they can report to senior management and close the outstanding issue, ensuring that all audit recommendations are appropriately resolved.
Other Options:
Accepting Management's Explanation: Without verification (option B) is not appropriate as it may leave risks unmitigated.
Escalating Without Verification: Advising management and escalating (option C) is premature if the new system may already address the issues.
Detailed Process Evaluation: Requiring additional details about the process (option D) may be unnecessary if the auditor can verify the controls directly.