Which of the following should a general internal auditor be able to characterize as an IT-related risk?

Which of the following would provide the best assessment of an organization's ethical climate?

Sometimes,internal audit staff may partner with operating managers to rank risks. Which of the following outcomes may be the most beneficial aspects of this strategy?
1.Reappraising risks levels.
2.Providing accurate information to management.
3.Marketing the internal audit activity.
4.Planning safeguards for assets in high-risk areas.

Which of the following actions would be considered a violation of the Standards?
I.Drafts of engagement communications were reviewed with the audit client to obtain input. The client's comments were considered when developing the engagement final communication.
II.An auditor participated as part of a development team to review the control procedures to be incorporated into a major computer application under development.
III.Given limited resources,the chief audit executive performed a risk analysis to determine which functions to audit.

An internal auditor for a large computer company suspects that returned computer systems are being repackaged as new products and shipped to other customers before the defects have been repaired. Which of the following would be the most persuasive piece of evidence in support of the auditor's suspicions?