A chief audit executive (CAE) used an electronic spreadsheet to facilitate the risk assessment process for a number of different divisions. The spreadsheet included the following factors Complexity of operations Competence of divisional personnel Dollar amount of accounts where management's judgment can affect the expense. The CAE used a group meeting of audit managers to reach a consensus on the competence of divisional personnel. Other factors were assessed as high, medium, or low risk by either the CAE or an audit manager who had audited the division. The CAE weighted each factor and computed a composite risk score. Which of the following statements is correct regarding this risk assessment process?
- The risk analysis would not be appropriate because it mixes both quantitative and qualitative factors.
- Assessing factors at discrete levels, such as high, medium, and low, is inappropriate for the risk assessment process because the ratings are not quantifiable.
- The weighting is subjective and should have been determined through a process such as multiple regression analysis.
- Using a subjective group consensus to assess personnel competence is appropriae.