When planning a risk assessment, the auditor should first review the agency's acquisition policies and directives to identify the organizations and individuals responsible for approving procurements.
The auditor should review policies and directives.
The auditor should not review policies and directives.