To identify those components of a telecommunications system that present the greatest risk, an internal auditor should first:

Which of the following should be incorporated in a risk management policy?
I.Boundaries and limit structures.
II.
Requirements for reporting risk.
III.
Risk authorities.

In publicly held companies, management often requires the internal audit activity's involvement with quarterly financial statements that are made public and used internally. Which of the following is generally not a reason for such involvement?

What would a chief audit executive most likely recommend that an internal auditor do to prepare for an increased demand in advisory services?

The chief audit executive (CAE) routinely provides activity reports to the board during quarterly board meetings. Senior management has asked to review the CAE's board presentation before each board meeting so that any issues or questions can be discussed beforehand. The CAE should: