When planning a risk assessment , the auditor should first review the agency 's acquisition policies and directives to identify the organizations and individuals responsible for approving procurements .
The auditor should review policies and directives .