Comprehensive and Detailed Step-by-Step Explanation:
* Risk and Control Matrix: A risk and control matrix links business objectives, the risks threatening those objectives, and the likelihood and impact of the risks. It is used to prioritize areas for review and identify necessary controls.

Comprehensive and Detailed Step-by-Step Explanation:
* Definitions from Risk Management Frameworks (e.g., COSO ERM):
* Inherent Risk: The raw or natural level of risk before any controls or mitigating actions are applied.
* Residual Risk: The remaining level of risk after implementing controls or risk responses.
* Reasoning:
* Option C is correct because it captures the essence of inherent risk as the baseline risk level and residual risk as the mitigated level after control actions.
* Option A inaccurately states that residual risk is tied to the completion of a risk assessment process instead of mitigation actions.
* Option B confuses inherent risk with risk appetite, which reflects the organization's tolerance for risk.
* Significance of Differentiation:
* Understanding both risk levels helps prioritize resources for managing critical risks and improving controls.

Comprehensive and Detailed Step-by-Step Explanation:
* Risk Acceptance: By deciding that transactions below $50 do not require authorization, management is consciously accepting the low-level risk associated with this decision to streamline processes and reduce administrative burdens.

Comprehensive and Detailed Step-by-Step Explanation:
* Reference to IIA Standards:
* Standard 2200 - Engagement Planning: The engagement work program outlines the resources, timelines, and procedures necessary to achieve the engagement's objectives.
* The work program must be approved to ensure alignment with objectives and resource requirements.
* Reasoning:
* Option B is correct because an approved engagement work program confirms that the scope, procedures, and resources were planned and allocated effectively.
* Option A (staff skills audit) evaluates team competencies but does not confirm specific resource allocation for an engagement.
* Option C (post-engagement survey) evaluates the outcome of the audit but does not provide evidence of initial resource planning.
* Significance of the Work Program:
* The work program ensures that the engagement is structured to meet objectives efficiently, with adequate and relevant resources.

Comprehensive and Detailed Step-by-Step Explanation:
* Competency: Continuous professional development ensures auditors maintain and enhance their knowledge, skills, and expertise, directly supporting their ability to perform engagements effectively.