11. The board’s expectation of the internal audit activity regarding the risk management process is
A. Noted in the work programs for formal consulting engagements.
B. Included in the business continuity plan.
C. Codified in the charters of the internal audit activity and the board.
D. Reviewed by the internal auditors immediately following a disaster.
Answer (C) is correct.
REQUIRED: The treatment of the board’s expectation of the internal audit activity regarding the risk management process.
DISCUSSION: The chief audit executive (CAE) is to obtain an understanding of senior management's and the board's expectations of the internal audit activity in the organization’s risk management process. This understanding is then codified in the charters of the internal audit activity and the board (PA 2120-1, para. 4).
Answer (A) is incorrect. A work program is a listing of specific procedures.
Answer (B) is incorrect. Business continuity planning is just one element of risk management.
Answer (D) is incorrect. The internal audit activity's role needs to be understood before a crisis.