Which of the following is true regarding the internal audit activity's plan of engagements in regards to assurance engagements?

The assertion that the risk assessment must be updated at least annually is correct because effective internal audit practice emphasizes that the internal audit activity should regularly assess risks to ensure that the audit plan remains relevant and aligned with the organization’s objectives and current risk landscape. An annual update of the risk assessment allows the internal audit team to identify new risks, changes in existing risks, and emerging trends that may affect the organization. This ongoing evaluation supports the prioritization of assurance engagements based on the most significant risks, thereby enhancing the overall effectiveness and efficiency of the internal audit process.

The other statements do not align with standard internal audit practices. While the engagement plan should consider various sectors of the organization, it is not a requirement for the plan to include every department, as some may have lower risk levels. Engagements are not typically bound by a strict 30-day completion rule; the timing will depend on the complexity and scope of each engagement. Lastly, while random sampling can be used, it is not a mandatory approach; auditors may utilize various sampling methods based on the objectives of the audit and the nature of the data being examined.