For each activity below, indicate whether it forms part of an assurance engagement or an advisory engagement.

Here's the categorization for each activity:

1. The internal audit team reviews student-fee refunds at a university. The auditors examine the approved refund procedures, test a sample of refunds for accuracy and authorisation, and evaluate whether controls prevent duplicate or fraudulent payments. A formal conclusion is reported to the audit committee.

   • This activity involves an objective examination of existing processes and controls to provide an independent assessment and conclusion.
   • Assurance engagement

2. Following security incidents, the internal auditors assess access controls at a financial institution. They inspect user-access records, test whether access is removed promptly, and determine whether privileged accounts are monitored effectively. The results are communicated to management.

   • This activity involves evaluating the effectiveness of existing controls and processes.
   • Assurance engagement

3. A municipality plans to introduce an online system through which residents can apply for building permits. Before implementation, management asks internal audit to identify potential risks and recommend appropriate controls. The internal auditors provide advice but do not select the software or approve the final system design.

   • This activity involves providing advice and recommendations for a future system, without providing an independent opinion on existing controls.
   • Advisory engagement

4. The internal audit function reviews environmental compliance at a mining company. The auditors inspect licences, test waste-disposal records and determine whether operations comply with relevant environmental legislation and internal policies. Instances of non-compliance are reported to senior management and the board.

   • This activity involves evaluating compliance with established regulations and policies and reporting findings.
   • Assurance engagement