ectangle 15. How does a control manage a specific risk? a. It reduces the likelihood of the event giving rise to the risk. b. It reduces the impact of the event giving rise to the risk. c. It reduces either likelihood or impact or both. d. It prevents the occurrence of the event. 12. Which of the following is true regarding business process outsourcing? a. Outsourcing a core, high-risk business process reduces the overall operational risk. b. Outsourced processes should not be included in the internal audit universe. c. The independent outside auditor is required to review all significant outsourced business processes. d. Management's controls to ensure the outsourcing provider meets contractual performance requirements should be tested by the internal audit function. 13. A company has recently outsourced its payroll process to a third-party service provider. An audit team was scheduled to audit payroll controls in the annual audit plan prepared prior to the outsourcing. What action should the audit team take, considering the outsourcing decision? a. Cancel the engagement, because the processing is being performed outside the organization, b. Review only the controls over payments to the third-party provider based on the contract. c. Review only the company's controls over data sent to and received from the third-party service provider d. Review the controls over payroll processing in both the company and the third-party service provider