An AI audit plan is being developed for an organization that uses AI in three high-risk areas: credit underwriting, anti-money laundering transaction monitoring, and HR performance evaluation. Resources are insufficient to fully audit all three in one cycle. How should audit prioritization be determined?

B is correct because audit prioritization should follow a risk-based approach — factoring in the intensity of regulatory scrutiny each area faces, the potential harm to affected individuals, and signals from ongoing monitoring or prior findings. This ensures audit resources are directed to the highest-risk areas. A is unprincipled. C reduces depth below effective assurance thresholds. D violates audit independence.