When setting the scope for the identification and assessment of key risks and controls in a process, which of the following would be the least appropriate approach?

Which of the following statements is true pertaining to interviewing a fraud suspect?
1. Information gathered can be subjective as well as objective to be useful.
2. The primary objective is to obtain a voluntary written confession.
3. The interviewer is likely to begin the interview with open-ended questions.
4. Video recordings always should be used to provide the highest quality evidence.

An internal auditor has been assigned to facilitate a risk and control self-assessment for the finance group.
Which of the following is the most appropriate role that she should assume when facilitating the workshop?

Which of the following is always true regarding the use of encryption algorithms based on public key infrastructure (PKI)?

According to the COSO enterprise risk management (ERM) framework, which of the following is not a typical responsibility of the chief risk officer?