When Assessing the Adequacy of a Risk Mitigation Strategy, an Internal

Multiple Choice

When assessing the adequacy of a risk mitigation strategy, an internal auditor should consider which of the following? 1. Management's tolerance for specific risks. 2. The cost versus benefit of implementing a control. 3. Whether a control can mitigate multiple risks. 4. The ability to test the effectiveness of the control.

A) 1, 2, and 3
B) 1, 2, and 4
C) 1, 3, and 4
D) 2, 3, and 4