where the internal audit manager reports functionally to a senior management official, is in accordance with the International Professional Practices Framework (IPPF) from the Institute of Internal Auditors (IIA), which states that internal audit functions should have a direct reporting line to the governing body or a senior management official in order to ensure objectivity and independence. This ensures that the internal audit function can provide accurate and unbiased information to senior management and the governing body.
Reference:
Institute of Internal Auditors. (2019). International Professional Practices Framework (IPPF). Institute of Internal Auditors. (Standards 2000.A2 and 2100.A1)

Business strategy is the most important for an IS auditor to review when determining whether IT investments are providing value to the business, because:
Business strategy is a plan or vision that defines the goals, objectives, and direction of the business, and how it intends to achieve them1234.
Business strategy is the basis for aligning and prioritizing IT investments with the business needs, expectations, and outcomes123 [4].
Business strategy is the source for identifying and measuring the benefits and value that IT investments deliver to the business, such as increased revenue, faster access to information, better customer service, or improved efficiency[1] 2^ 3^ 4.
Business strategy is the criterion for evaluating and communicating the performance and impact of IT investments on the business success[1] 2^ 3^.