An organization should implement an internal audit process for business continuity, whose purpose is to evaluate the performance of the Business Continuity Management System $($BCMS$).$ While the scope of audit activities and deliverables may vary, in all cases they must encompass an independent and objective evaluation of the effectiveness of the BCMS$.$

Which one is NOT the key task for internal auditing?

Group of answer choices

Establish and implement the audit program.

Ensure that the audit program is capable of determining whether the BCMS conforms to requirements.

Provide assurance on the BCMS$.$

Ensure that top management reviews the effectiveness of the audit program.

Ensure that the audit program is capable of determining whether the BCMS conforms to the BC plan.