Which of the following would best assist the internal audit activity in assessing whether an organization's responses to risk are aligned with its risk appetite...