What should the auditor assess to verify the establishment of an internal audit program?

To verify the establishment of an internal audit program, the auditor must ensure there is a documented and systematic approach for planning, conducting, and maintaining internal audits. ISO/IEC 42001:2023 (Clause 9.2) and ISO 19011:2018 emphasize the need for audit programs to be risk-based and consistently applied — not random or ad hoc.

While general objectives and scope are important, they must be part of a structured program and planning process, making Option B the most accurate.