Which of the following statements is MOST ACCURATE regarding an organization ' s fraud risk...

Formal sanctions for intentional noncompliance should be kept private and only shared if a party absolutely needs to know.

All employees at the organization should be responsible for monitoring compliance with the program.

Punishment for intentional noncompliance should be individualized based on the offender ' s personal circumstances.

Systems to monitor and identify breaches in compliance must be included in the fraud risk management program.