When assessing the adequacy of a risk mitigation strategy, an internal auditor should consider which...

The defensible answer is B. When assessing whether a risk mitigation strategy is adequate, internal audit should consider management’s risk tolerance, the cost-benefit relationship of the control, and whether the control’s effectiveness can be tested. Risk tolerance determines whether residual risk is acceptable. Cost-benefit analysis is necessary because controls should be proportionate to the risk. Testability matters because a control that cannot be evaluated provides weak assurance. Whether one control can mitigate multiple risks may be efficient, but it is not a core adequacy criterion. A control can mitigate only one major risk and still be fully adequate. Internal audit should focus on residual risk, control design, operating effectiveness, and alignment with risk appetite. Therefore, Option B is correct.