The CAE is asked to lead the enterprise risk assessment as part of an organization’s implementation of ERM. Which of the following would not be relevant with respect to protecting the internal audit function’s independence and the objectivity of its internal auditors?
a. A cross-section of management is involved in assessing the impact and likelihood of each risk.

b. Risk owners are assigned responsibility for each key risk.

c. A member of senior management presents the results of the risk assessment to the board and communicates that it represents the organization’s risk profile.

d. The internal audit function obtains assistance from an outside consultant in the conduct of the formal risk assessment session.