If management has not established a risk management process, the internal audit activity could.

Which of the following is a key performance indicator for an internal audit function?

Which of the following is least likely to be considered material in an audit of a medium-sized organization?

Which of the following control methods is effective in reducing the risk of purchasing-scheme fraud?
Periodically reviewing the vendor list for unusual vendors and addresses.
Segregating duties for amount purchasing, receiving, shipping, and accounting.
Validating sequential integrity of purchase orders.
Verifying the validity of invoices with post office box addresses.

Which of the following would provide the most reliable information on the risk associated with an auditable activity?