Luis, the internal audit manager for Oak Corporation, is working to formally incorporate the company’s...

Internal audit should use the fraud risk assessment to focus audit work on the organization’s significant fraud risks and related controls. The CFE material explains that auditors should consider fraud risks when assessing internal control design and determining audit steps. They should evaluate whether controls are adequate, operating as intended, and mitigating fraud risk effectively and efficiently. Option C is therefore correct. Option A is incorrect because the audit process is not designed merely to confirm conclusive evidence of existing fraud. Option B is too broad because audit resources should be risk-based, not applied equally to every area with any level of fraud risk. Option D is too narrow because internal audit should focus particularly on moderate-to-high risks. The best use is designing tests of anti-fraud controls.