text: When planning a risk assessment , the auditor should first review the agency 's acquisition policies and directives to identify the organizations and individuals responsible for approving procurements .
  
  ###
  
  The auditor should review HR policies and directives .