According to the IIA Standards, internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which IT is managed. This includes understanding their organization's IT governance, risk, and control processes (Option D). Standard 1210.A3 specifies that internal auditors must have sufficient knowledge of key information technology risks and controls and available technology-based audit techniques to perform their assigned work. This ensures that auditors can effectively assess and contribute to the improvement of the organization's IT governance and control environment.References:
* IIA Standards, Standard 1210.A3: Proficiency - Technology-based Audit Techniques
* IIA's International Professional Practices Framework (IPPF)