You are required to write an expanded risk management guide titled "20 Questions Directors/Auditors/CIOs/management should Ask about Phishing.

The 20 questions you write should address risk, control and audit issues (audit issues would apply only to auditors).

Each question should be separate and distinct (i.e., do not combine two questions into one big question).

Use the "20 Questions Directors should Ask about IT" on phishing. Use only one audience in your report.