When considering fraudulent activities, the internal audit department should

1. Stay out of the way and let fraud experts implement the processes and controls related to fraud risk management
2. Should be heavily involved and be the owners of some of the processes and controls related to fraud risk management
3. Neither a. or b
4. Both a. and b