According to IIA guidance, which of the following is the strongest indicator of deficiencies in the risk management process?

A bank uses a risk analysis matrix to quantify the relative risk of auditable entities. The analysis involves rating auditable entities on risk factors using a scale of 1 to 10, with 10 representing the greatest risk. A partial list of risk factors and the ratings given to three of the bank's departments is provided below:
Department
Risk Factor
A
B
C
Control structure
9
5
7
Nature of assets in department
2
7
9
Dollar value of assets
6
6
8
Complexity of transactions
3
4
8
Which of the following statements regarding risk in the departments is true?

A company has established its environmental audit activity as part of its legal department rather than part of its internal audit activity, which reports to the audit committee. The board has requested that the chief audit executive (CAE) provide an annual opinion on whether environmental risks are being properly addressed. In these circumstances, the CAE should recommend to the audit committee that the internal audit activity:

This chief audit executive (CAE) engaged an internal auditor to consult on an organization's complex information technology system. Shortly after beginning the engagement, the auditor unexpectedly resigned. Unfortunately, this auditor was the only available auditor with the necessary expertise. The CAE will not be able to hire someone with similar expertise in time to meet a regulatory deadline. Which of the following would be the best course of action for the CAE to take?

An organization receives the most value from an internal audit activity's enterprise-wide risk assessment when the auditor: