When assessing the risk associated with an activity, an internal auditor should: a) Determine how the risk should best be managed. b) Provide assurance on the management of the risk. c) Update the risk management process based on risk exposures. d) Design controls to mitigate the identified risks. 12. In deciding whether to schedule the purchasing or the personnel department for an audit engagement, which of the following would be the least important factor? a. There have been major changes in operations in one of the departments. b. The audit staff has recently added an individual with expertise in one of the areas. c. There are more opportunities to achieve operating benefits in one of the departments than in the other. d. The potential for loss is significantly greater in one department than in the other. 13. A performance audit engagement typically involves: a. Review of financial statement information, including the appropriateness of various accounting treatments. b. Tests of compliance with policies, procedures, laws, and regulations. c. Appraisal of the environment and comparison against established criteria. d. Evaluation of organizational and departmental structures, including assessment of process flows