The chief audit executive (CAE) of a multinational corporation has been assigned to assist management...

An internal control framework should support the achievement of organizational objectives and enable risks to be managed within established parameters. Therefore, the organization’s strategic goals and risk appetite are the most important factors when determining whether a framework is suitable. Strategic objectives establish what the organization is trying to achieve, while risk appetite establishes the amount and type of risk it is willing to accept while pursuing those objectives. IT infrastructure, organizational size, and geographical dispersion are relevant implementation considerations, but they should be evaluated within the broader context of strategy and risk. The CEO’s personal views alone should not determine the framework because control and risk governance must reflect formally established organizational objectives and stakeholder expectations. Consequently, option C provides the strongest basis for selecting a comprehensive internal control framework.