The IIA's Standards require which of the following? When the CAE concludes that management has accepted a level of risk that may not be acceptable to the organization, the CAE must discuss the matter with the senior management. Internal auditors must develop and document work programs that achieve the engagement objectives. The internal audit plan of engagements must be based on a documented risk assessment undertaken at least annually. All the above