A.Adherence to the organization's position classification structure.

B.The existence of a formal written charter for the internal audit activity.

C.A direct reporting relationship to the audit committee.

D.Submission of an annual internal audit work plan to the audit committee.

A.Enterprise risk management is broader than governance and internal control, and focuses on activities designed to ensure that risks are contained at a level acceptable to the enterprise.

B.Enterprise risk management is broader than internal control and focuses on risk identification and management, and assurance that business objectives will be met.

C.Enterprise risk management is narrower than internal control and focuses on managing the risk of loss resulting from external events.

D.Enterprise risk management is narrower than internal control and focuses on risk mitigation strategies across the enterprise.

A.Provide guidance to govern information technology activities.

B.Assist technology professionals in interpreting technological specifications.

C.Define auditing standards for information technology auditors.

D.Satisfy information technology regulatory requirements.

A.Unannounced audits or reviews of programs or departments.

B.Detective controls built into the daily processes.

C.Tips received from employees or citizens.

D.Analytical reviews of high-risk areas.

A.To enable Triple Bottom Line reporting capability.

B.To achieve and maintain sustainable development.

C.To facilitate the conduct of risk assessment.

D.To fulfill regulatory and compliance requirements.