Choice "C" is correct. Periodically comparing and updating the mission vision and values of a not-for-profit could best be classified as a monitoring activity.
Choice "a" is incorrect. Control activities are typically those procedures that implement rather than monitor controls.
Choice "b" is incorrect. Risk assessment components of internal control programs relate to periodic evaluations of what could go wrong and the effectiveness of procedures to prevent or detect errors or irregularities.
Choice "d" is incorrect. Information and communication components of internal control relate to the periodic reporting on the effectiveness of controls.