A project team performs monthly risk audits for a project in which a large number of identified risks have been realized. So far, the risk responses have been appropriate, and reserves are sufficient. An executive for the requesting organization chides the project manager for doing risk audits improperly, stating that like all audits, outside independent resources need to perform risk audits. How should the project manager respond?
 

A. Explain that risk audits can be performed either internally or externally as long as they follow the project management plan
B. Agree with the executive and submit a change request to update the project management plan to have the audits conducted externally
C. Follow the guidance provided by the executive and hire a team of external auditors to conduct the risk audits going forward
D. Explain that if the current risk audits are not sufficient, then a comprehensive project audit should be carried out
 

HINT: Risk audits consider the effectiveness of the risk management process.