What should an internal audit function do when performing an advisory engagement for an organization?

For advisory services, the nature and scope of the work are subject to agreement with the relevant stakeholder or engagement client. This is a defining feature of advisory engagements under IIA guidance because the service is designed around the stakeholder’s requested needs while preserving internal audit’s objectivity and avoiding management responsibility. Option A is too broad because it states that the detailed understanding must be documented for all engagements; documentation requirements vary depending on the nature and significance of the engagement. Internal auditors must not assume managerial responsibility, making option C inappropriate. An annual advisory plan based solely on internal audit’s risk assessment is also not required, because advisory work can arise from stakeholder requests and emerging needs. Therefore, agreeing with management on the nature and scope is the best answer.