A senior auditor in an organization with a well-established risk management program is planning an audit of the accounts payable department. According to IIA guidance, which of the following strategies would be the most effective way to help ensure all key controls are managed effectively?

a. Conduct facilitated sessions with business process users to identify key controls

b. Obtain the prior years work program and compare the key controls previously identified

c. Review managements identification and assessment of key controls for adequacy

d. Engage IT audit resources to ensure key system controls are identified

The timing of follow-up on audit observation is dependent upon which of the following?

a. Age of the observations

b. Importance of the observations

c. Type of observations

d. Number of observations