An indicator that an organization ' s risk management processes are effective is that organization-wide mechanisms exist to enable the identification and assessment of all significant risks. This approach ensures that risks are managed on an enterprise-wide basis, aligning risk management strategies with the organization ' s objectives and promoting a comprehensive understanding and management of risks throughout the entity.
References: Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF), Risk Management in Practice

An important aspect of an internal auditor's role in fraud management is utilizing analytical techniques to actively discover instances of potential fraud. Internal auditors play a critical role in fraud detection by employing data analysis and other analytical methods to identify unusual patterns, anomalies, or red flags that could indicate fraudulent activities. By proactively using these techniques, auditors can help uncover fraud early and provide valuable insights to management for timely intervention.
The IIA Standards: Standard 1220 - Due Professional Care: "Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor." IIA Practice Guide: "Fraud Prevention and Detection in an Automated World": Emphasizes the use of analytical techniques for identifying potential fraud.

Ensuring an organization's risk management program remains effective over time is most critically supported by conducting a combination of ongoing risk reviews and individual evaluations. This approach allows for continuous monitoring and updating of the risk landscape, ensuring that the risk management processes adapt to changes in both internal and external conditions.
IIA guidance on effective risk management practices

The statement that an employee who diverts the organization's purchases for personal use is demonstrating asset misappropriation is true regarding occupational fraud. Asset misappropriation involves the theft or misuse of an organization's assets and is one of the most common types of occupational fraud. Using organizational resources for personal benefit directly falls under this category.
References: Association of Certified Fraud Examiners (ACFE) reports and guidance on types of occupational fraud.

Training programs are an example of directive controls as they are designed to direct staff behaviors towards compliance with organizational policies and procedures. Directive controls guide or mandate specific behaviors to achieve desired outcomes, unlike preventive controls like segregation of duties, or detective controls like exception reports and supervisory review.
Internal control frameworks and definitions commonly used in internal auditing practices.