Management Requested the Chief Audit Executive (CAE) to Include an Audit

Management requested the chief audit executive (CAE) to include an audit of the organization's health and safety program in next year's annual audit plan. However, the internal audit department has no expertise in this area. Which of the following would be the most appropriate action by the CAE?

A) With management's agreement, amend the scope of the audit to ensure that areas examined do not require specialized knowledge and expertise.
B) Meet with management to explain that the audit cannot be undertaken and discuss alternative strategies that can be implemented until internal audit can develop its capability in the area.
C) Accept the request provided management has conducted a thorough risk assessment prior to the engagement to help guide the audit.
D) Advise management that compliance audits of this type should only be conducted by the corresponding regulatory agency to ensure independence.