Text: When planning a risk assessment, the auditor should first review the agency's acquisition policies and directives to identify the organizations and individuals responsible for approving procurements.
Entailment: The auditor should review policies and directives.
Contradiction: The auditor should not review policies and directives.