Which of the following statements is true regarding internal controls?

For assurance engagements, internal auditors should plan to assess the effectiveness of all entity-level controls.

Poorly designed or deficient entity-level controls can prevent well-designed process controls from working as intended.

During engagement planning, internal auditors should not discuss the identified key risks and controls with management of the area under review, to prevent tipping off probable audit tests.

Reviewing process maps and flowcharts is an appropriate method for the internal auditor to identify all key risks and controls during engagement planning.