Câu 38: IIA-CHAL-QISA: Qualified Info Systems Auditor CIA Challenge

According to IIA guidance, which of the following statements is true regarding risk management in an organization?

1. A. The risk management function has the sole responsibility for identifying and managing risks in all departments.
2. B. Risk management is a core responsibility of the internal audit activity.
3. C. The internal audit activity should consider the organization’s maturity, structure, and the competitive environment to establish the organization’s risk appetite.
4. D. The internal audit activity may use a risk management or control framework to assist in risk identification. — đáp án hiện tại