Take the following as truth: When planning a risk assessment, the auditor should first review the agency's acquisition policies and directives to identify the organizations and individuals responsible for approving procurements.
Then the following statement: "The auditor should review HR policies and directives." is true, false, or inconclusive?