Which of the following statements best describes how the internal audit activity obtains reasonable assurance...

The internal auditors review the organization's strategic plan, business plan, and policies, and have discussions with the board and senior management.

The internal auditors evaluate the adequacy and timeliness of management's reporting of risk management results.

The internal auditors interview staff at various levels and determine whether the organization's objectives, significant risks, and risk appetite are articulated sufficiently.

The internal auditors review recently completed risk assessments and related reports issued by senior management, external auditors, and other sources.