The annual audit plan needs to favor areas with the highest live risk. What selection approach matches IRM audit architecture?
Select an answer to reveal the explanation.
Short Explanation
Risk-based auditing is like sending inspectors where the hazard map is reddest, not where the alphabet starts. Use the live risk register to choose engagements. Volunteer-only or A-to-Z planning ignores the heat.
Full Explanation
Annual audit planning that must favor areas with the highest live risk should use risk-based auditing that selects engagements using the live risk register. Inspectors go where the hazard map is reddest, not where the alphabet starts or where volunteers raise their hands. IRM audit architecture exists to connect assurance effort to residual posture.
Picking engagements alphabetically by department name only ignores risk. Selecting only entities that have never had a control test may miss high residual areas that are tested but still risky. Auditing only departments that volunteer, regardless of risk ratings, lets low-risk polite departments crowd out high-risk reluctant ones.
Exam caveat: risk-based selection from the live register is the CIS-RC pattern—not alphabet, never-tested-only, or volunteer-only schemes.
Operational check: rank candidate engagements by live residual and appetite breach density; justify the annual plan with register extracts; show council/audit committee the linkage between heat and planned coverage.
Present the annual plan heat map beside live residual charts so audit committees see why certain departments are selected. Revisit mid-year if new critical risks emerge; do not lock the plan to alphabetical convenience or volunteer interest.