An internal auditor performed a risk assessment and concluded that the controls over access privileges...

Due professional care was exercised, despite the auditor’s failure to identify the significant risk.

Due professional care was not exercised because the auditor failed to identify all the significant risks during the risk assessment.

Due professional care was not exercised because the residual risk from the possibility of authorized users sharing their passwords was not considered.

Due professional care was not exercised because the auditor failed to conduct interviews to obtain testimonial evidence of possible password sharing