Which of the following statements is MOST ACCURATE regarding an organization's fraud risk management program?

Formal sanctions for intentional noncompliance should be kept private and only shared if a party absolutely needs to know.

All employees at the organization should be responsible for monitoring compliance with the program.

Punishment for intentional noncompliance should be individualized based on the offender's personal circumstances.

Systems to monitor and identify breaches in compliance must be included in the fraud risk management program.