External and internal IT auditing are similar in terms of approach, reporting structure, and the need to exercise due professional care and professional skepticism. Which of the following is NOT correct with regard to external and internal IT auditing?

The external and internal IT auditor should possess strong communication skills given the need to report to management and the audit committee.

The external IT auditor is primarily concerned with financial statement risk related to the flow of financial transactions.

The internal IT auditor is concerned about all three components of the COSO framework – legal, operational and financial risks.

The external IT auditor, according to Generally Accepted Auditing Standards (GAAS), guarantees that financial systems produce valid, reliable, complete, and timely financial reporting information to the investing public and other stakeholders.