The annual audit plan needs to favor areas with the highest live risk. What selection approach matches IRM audit architecture?
Select an answer to reveal the explanation.
Short Explanation
Risk-based auditing is like sending inspectors where the hazard map is reddest, not where the alphabet starts. Use the live risk register to choose engagements. Volunteer-only or A-to-Z planning ignores the heat.
Full Explanation
Risk-based audit planning prioritizes engagements using current risk information from the IRM risk register (and related factors), aligning audit effort with organizational exposure. Alphabetical selection, testing virgin entities only, or volunteer-only scheduling are not risk-based architecture.