A chief audit executive has decided to use the process element approach to evaluate the...

Risk evaluation involves analyzing identified risks to determine their significance. A formal technique that evaluates both the likelihood of a risk event and its potential consequences provides clear evidence that risk evaluation is occurring. Identifying sources, areas of impact, and potential events corresponds primarily to risk identification. Ranking risks according to relative importance is risk prioritization, which generally follows evaluation. Selecting avoidance, sharing, or controls represents risk treatment or response. Effective risk management therefore follows a logical progression: identify relevant risks, evaluate their likelihood and impact, prioritize them, and determine suitable responses. The Internal Audit Fundamentals material similarly identifies effective risk management as requiring organization-wide mechanisms for identification and adequate assessment of significant risks. Accordingly, option C specifically demonstrates that the risk evaluation element has been established.