Which combination of strategies would provide the best evaluation of the effectiveness of the organization's risk assessment activity?
1. Interview staff at various levels to discuss the organization's objectives, significant risks, and risk appetite.
2. Review board meeting minutes to determine whether the significant risks identified are communicated timely to the board.
3. Evaluate the adequacy and timeliness of management remediation actions by reviewing the control design, testing the controls, and reviewing monitoring procedures.
4. Review the professional development plans of internal audit staff to ensure all are competent to assess the organization's risk assessment activity.
Submit