1) Should individual audit findings be risk ranked? Why or why not? If yes, what are the typical rankings used? Do you recommend including an overall 'Audit Opinion' in the Audit Report?
2) When can internal auditors report that their engagements are "conducted in conformance with the International Standards for the Professional Practice of Internal Auditing"? Elaborate using the relevant IIA Standards.