The internal auditor is considering performing a risk analysis as a basis for determining which areas of the organisation ought to be examined. Which one of the following statements is correct regarding risk analysis?

a.

Risk analysis must be reduced to quantitative terms in order to provide meaningful comparisons across the organisation.

b.

The extent to which management's judgement are required in an area could serve as a risk factor in assisting the auditor in making a comparative risk analysis.

c.

The highest risk assessment should always be assigned to the area with largest potential loss.

d.

The highest risk assessment should always be assigned to the area with highest probability of occurrence.