Which of the following should an internal auditor take into consideration when making a judgement regarding whether management selected appropriate risk responses?

An internal auditor is updating the risk register for risks identified during a recent organizational risk assessment. According to the Standards, which of the following would the auditor include in the risk register?

In its five years of existence, an internal audit activity conducted a single internal assessment of its quality assurance and improvement program (QAIP). The results of that assessment showed that the internal audit activity did not conform with the Standards. Prior to this, an external assessment of the internal audit activity's QAIP was conducted, which reported that the internal audit activity was in conformance with the Standards. Considering the two assessments, what would be the internal audit activity's current state of conformance with the Standards?

Which of the following should be part of the internal audit activity's duties?

Which of the following activities would an internal auditor perform as a consulting engagement for an organization?