According to IIA guidance on IT auditing, which of the following would not be an area examined by the internal audit activity?
Access system security.
Policy development.
Change management.
Operations processes.
Submit