1. Which of the following would be least likely to be an audit comment from a risk management audit?

A) There is insufficient integration of risk management into the business

B) The internal auditing department is not following the IPPF

C) Strategic planning activities do not apply risk assessment properly

D) Risk management does not lead to more effective internal controls

E) Risk ownership is not properly defined