Final answer:
Risk involves both the likelihood of an event and its impact on an organization. Therefore, the work of internal audit activity in terms of evaluating risk includes considering these two aspects. The correct answer is C. II and III only.
Step-by-step explanation:
In the context of the internal audit activity, risk is not just the negative effect of events certain to occur. Instead, risk encompasses both the likelihood of an event happening and the impact it would have should it occur. Therefore, risk can be:
- Measured in terms of impact, which refers to the significance or consequence of the event on the organization.
- Measured in terms of likelihood, which quantifies the probability that an event will happen.
Given this understanding of risk, the correct answer to the question is C. II and III only.