Question 16 (2 points) When assessing the risk associated with an activity, an internal auditor should: Determine how the risk should best be managed. Update the risk management process based on risk exposures. Design controls to mitigate the identified risks. Provide assurance on the management of the risk