Why should internal audit activities be connected and appropriate to the risk management process as an auditor for a company?