Which of the following is an advantage of an internal audit activity coordinating with a management-defined risk universe?

a. Increased completeness, including risk categories like political, supplier, and social media

b. Business managers can identify and assess risks that occur within each category

c. The internal audit activity can rely on managements risk assessment

d. Organizationwide audits are required since risk events within categories occur in many different ways

During the review of an organizations retail fraud deterrence program, an employee mentions that an expensive fraud surveillance information system is rarely used. The internal auditor concludes that additional staff are required to properly utilize the system to its full potential. According to IIA guidance, which criteria for evidence is most lacking to reach this conclusion?

a. Sufficiency

b. Reliability

c. Relevancy

d. Usefulness