When evaluating an organization's ERM, an Internal Auditor would be least likely to consider: Whether management has identified responses to significant risks. Whether Key Risk Indicators have been defined and are regularly reported to senior management Whether the auditor agrees with the Risk Responses chosen by management for each risk. Whether a formal process for identifying risks in all significant areas of the organization exists