A change in which of the following would require a revalidation of the baseline?

Revalidation of the baseline is essential in a risk assessment context when there are significant changes in certain key areas. Each choice presented plays a crucial role in the integrity and effectiveness of internal controls.

When the process that is the object of internal control changes, it can alter how risks are managed and mitigated. If the processes themselves are updated—whether through changes in procedures, technology, or personnel—this can impact the effectiveness of existing controls, necessitating a review and revalidation.

Similarly, changes to the controls themselves directly affect how risks are addressed. If the internal controls are modified or replaced, the risk assessment baseline must be updated to align with these new controls, ensuring that the organization continues to be protected against identified risks.

Moreover, any change in risk exposure—such as new threats or changes in the risk landscape—should prompt a revalidation of the baseline. This includes emerging risks that were previously not considered or shifts in the organization's operational environment that could increase vulnerability.

Given that all three factors—changes in the process, controls, or risk exposure—can independently warrant a revalidation of the baseline, the most comprehensive answer is that all of these components must be monitored and assessed collectively for continued effectiveness in a risk management strategy.