The CAE has completed a risk assessment, identified the areas with the highest risks, and assigned an engagement priority to each. Which of the following conclusions most logically follow(s) from such a risk assessment? I. Items should be quantified as to risk in the rank order of quantifiable monetary exposure to the organization. II. The risk priorities should be in order of major control deficiencies III. The risk assessment process, though quantified, is the result of professional judgments about both exposures and probabilities of occurrences. II and III only I only II only III only