When examining risk management, internal audit must evaluate risk exposures relating to governance, operations, and information systems. Governance risks concern oversight, ethics, accountability, and decision-making. Operational risks concern efficiency, effectiveness, asset protection, and achievement of business objectives. Information systems risks concern confidentiality, integrity, availability, reliability, and security of information. Organizational structure may influence risk ownership and control accountability, but it is not listed here as one of the main required exposure categories in the same way as governance, operations, and information systems. Internal audit planning should therefore assess whether key risk exposures across governance, operations, and technology are identified, assessed, and managed within risk appetite. The correct combination is items 1, 2, and 3 only. Therefore, Option C is correct.