Which of the following would not be a factor for senior management to consider when determining the internal audit activity’s role in an organization’s risk management process?

A. The extent to which the internal audit activity is outsourced.

B. The maturity level of risk management practices in the organization.
C. The competency of the internal auditors in risk management.
D. The nature of the business and the environment in which the organization operates.