Answer (C) is correct. According to Standard 1000.C1, the nature of consulting services should be defined in the charter. Internal auditors have traditionally performed many types of consulting services, including the analysis of controls built into developing systems, analysis of security products, serving on task forces to analyze operations and make recommendations, and so forth. The board (or audit committee) should empower the internal audit activity to perform additional services if they do not represent a conflict of interest or detract from its obligations to the committee. That empowerment should be reflected in the internal audit charter (PA 1000.C1-1).