An internal auditor developed a list of internal and external risk considerations across the organization's processes, developed a scale to assess each risk and allocated the relative importance of each risk. When of the following approaches did the auditor take? A. Top-down approach B. Process-Metrix approach C. Risk-factor approach D. Bottom up approach