Which of the Following Is an Appropriate Role for the Internal

Which of the following is an appropriate role for the internal audit activity with regard to the organization's risk management program?

A) Identify and manage risks in line with the organization's risk appetite.
B) Ensure that a proper and effective risk management process exists.
C) Attain an adequate understanding of the organization's key risk mitigation strategies.
D) Identify and ensure that appropriate controls exist to mitigate risks.