The chief audit executive (CAE) for an organisation has just completed a risk assessment process, identified the areas with the highest risks, and assigned an audit priority to each. Which of the following conclusions logically follows from such a risk assessment and are consistent with the IIA Standards?

(I) Items should be quantified as to risk in the rank order of quantifiable rand exposure to the organisation.

(II) The risk priorities should be in order of major control deficiencies.

(III) The risk process, though quantified, is the result of professional judgement about both exposures and probability of occurrences.

a.

II and III.

b.

I, II and III.

c.

I only.

d.

III only.