A risk audit determines the effectiveness of risk responses. 1 is incorrect because this answer describes the risk identification process. 2 is incorrect because this answer describes the risk analysis processes. 4 is incorrect because this answer describes the expected monetary value performed in quantitative risk analysis.