The statement that the risk management process supports internal audit by evaluating whether critical controls are adequate and effective is true. The risk management process provides a framework for identifying, assessing, and managing risks, and internal audit uses this information to evaluate the adequacy and effectiveness of controls in place to mitigate those risks. This support helps internal audit focus on areas of high risk and ensure that controls are functioning as intended.
References:
* IIA Standards: 2120 - Risk Management
* IIA Practice Guide: Assessing the Adequacy of Risk Management Processes