An independent consultant has been hired to conduct an ad hoc audit of an enterprise's information security office with results reported to the IT governance committee and the board Which of the follo

Acceptance of audit risks and opportunities is typically part of the audit planning and engagement letter, but the scope must be defined first to understand what risks or opportunities are being accepted.

Clearly defining the scope and stakeholders of the audit is critical because it sets the boundaries and objectives for the consultant's work, ensuring that the audit focuses on the specific areas and systems that the IT governance committee and board are concerned about. This prevents mission creep, ensures all relevant parties are identified for interviews or data collection, and ultimately leads to an audit report that directly addresses the enterprise's needs.

The organizational structure of the security office provides context but does not define what the audit will cover or who needs to be involved from a governance perspective.

The policies and framework used by the security office are important evidence or criteria for the audit, but the scope defines which policies and frameworks are relevant to the audit engagement.