When gaining an understanding of management's risk tolerance levels which steps should an internal auditor follow?
1. Identify Possible Risk Outcomes
2. Understand Established Tolerance Levels.
3. Assess Tolerance Levels for Outcomes that Have Not Been Established.
4. Establish Final Tolerance Levels as determined by the CEO and CFO.
2,3,4
1,2,3
1,2,4
1,2,3,4