The risk is caused by incompatible duties: the same manager can approve vendor setup and initiate purchases.
The best control is segregation of duties through separate vendor creation and approval teams. This prevents one person from creating a fictitious vendor and then generating purchase orders to that vendor without independent review. A code of conduct and conflict-of-interest declaration are useful ethical controls, but they are weaker because they depend on honesty and self-reporting. Vendor master file review is detective and may identify problems after improper vendors already exist. Internal audit should evaluate whether vendor creation, vendor approval, purchase authorization, receiving, invoice approval, and payment functions are properly separated. Therefore, Option A is correct.