Which of the following options is the most accurate explanation of the internal auditor's first step toward understanding risk management in an area under revie...