Which of the Following Would Be a Legitimate Action for the Internal

Multiple Choice

Which of the following would be a legitimate action for the internal auditor to take when monitoring audit engagement results? 1. Disregard a certain risk because management and the board accepted the risk in the past. 2. Abdicate the responsibility for a particular risk because it is not part of the audit plan. 3. Obtain agreement from senior management that unresolved audit issues will be reported to the board. Request corrective action from management in writing.

A) 1 and 3 only
B) 2 and 3 only
C) 3 and 4 only
D) 1, 2, and 4 only