Prioritizing Engagements by Risk
5 minutes
5 Questions
Prioritizing engagements by risk is a core principle of risk-based audit planning and a key competency within the Certification in Risk Management Assurance (CRMA). Rather than auditing areas on a fixed rotation or by habit, internal audit allocates its limited resources to the activities, processes, and entities that pose the greatest risk to achieving organizational objectives. This ensures assurance effort adds maximum value and that the board and senior management receive insight where it matters most. The process begins with the audit universe, a comprehensive inventory of all auditable units, such as business processes, locations, systems, projects, and third-party relationships. Each unit is then assessed against risk criteria, typically combining impact (financial, operational, reputational, regulatory, strategic) and likelihood, along with factors such as control environment maturity, complexity, rate of change, management concerns, time since last audit, and results of prior engagements. Many functions use a scoring model that produces a composite risk rating, often visualized through heat maps or ranked lists. Critically, the assessment should align with the organization's enterprise risk management (ERM) framework and risk appetite, so audit priorities reflect the risks management itself considers significant, while also challenging blind spots. Inputs from strategic plans, regulatory developments, emerging risks, and stakeholder interviews enrich the analysis. High-risk areas receive priority for engagements with greater depth and frequency; moderate-risk areas may be covered through lighter or cyclical reviews; low-risk areas may rely on management self-assessment or continuous monitoring. The resulting plan should remain dynamic, revisited periodically or when significant events occur, such as mergers, new systems, or control failures, so coverage keeps pace with changing conditions. Finally, the rationale for prioritization must be documented and communicated to the audit committee, including coverage gaps and residual exposure left unaddressed due to resource constraints. This transparency, emphasized in IIA standards, demonstrates that the audit plan is defensible, objective, and genuinely responsive to the organization's risk profile.
Prioritizing Engagements by Risk: A Complete CRMA Study Guide
Overview
Prioritizing engagements by risk is the heart of risk-based audit planning. It is the process by which the chief audit executive (CAE) decides which areas of the organization will receive internal audit attention, in what order, and with how much effort, based on the significance of the risks those areas pose to the achievement of organizational objectives. For the IIA Certification in Risk Management Assurance (CRMA) exam, this topic sits inside the domain on Risk-Based Audit Planning and Engagements, and it is tested heavily because it connects risk management concepts directly to the practical work of internal audit.
Why Prioritizing Engagements by Risk Is Important
Internal audit functions never have enough resources to audit everything. A typical audit universe may contain hundreds of auditable entities (processes, business units, systems, projects, locations, compliance obligations), yet the audit plan might support only thirty to sixty engagements a year. Without a disciplined, risk-based method of choosing, the function would default to habit, convenience, or whoever shouts loudest. Risk-based prioritization matters for several reasons:
1. Alignment with the Standards. The IIA Global Internal Audit Standards (effective January 2025) require the CAE to develop an internal audit plan that is based on a documented assessment of the organization's strategies, objectives, and risks (Standard 9.4, Internal Audit Plan), informed by an understanding of governance, risk management, and control processes (Standard 9.1). The predecessor 2017 Standard 2010 (Planning) carried the same requirement. Examiners expect you to know that risk-based planning is mandatory, not optional.
2. Value to the board and senior management. The board wants assurance over the risks that could actually prevent the organization from achieving its strategy. Prioritizing by risk ensures audit effort is spent where failure would hurt the most, giving the board meaningful rather than cosmetic assurance.
3. Efficient use of scarce resources. Risk-based prioritization lets the CAE justify staffing, budget, and skill mix decisions and defend why certain areas were deferred.
4. Defensibility. If a significant failure occurs in an unaudited area, a documented risk-based rationale protects the credibility of the function. If a failure occurs in an area that was ranked low, the methodology can be examined and improved.
5. Linkage to enterprise risk management (ERM). A mature risk-based plan draws on the organization's own risk assessment, risk appetite, and risk register, creating coherence between the second line (risk management) and third line (internal audit) under the IIA Three Lines Model.
What Prioritizing Engagements by Risk Is
At its core, prioritization is a ranking exercise. The CAE and audit leadership take the full population of things that could be audited (the audit universe), assess each item against a consistent set of risk criteria, and then rank or tier them so that the highest-risk items are scheduled first, most frequently, and with the deepest scope. Lower-risk items are scheduled less often, covered through lighter-touch methods (continuous monitoring, self-assessment, reliance on other assurance providers), or consciously excluded with the board's awareness.
Key vocabulary you must know for the exam:
Audit universe: The complete inventory of auditable entities. It should be built from multiple lenses: organizational structure, business processes, strategic objectives, key risks, systems, regulatory obligations, and major projects or change initiatives.
Auditable entity (or auditable unit): A discrete item in the audit universe that can be scoped as an engagement.
Risk factors (or risk criteria): The attributes used to score each entity. Common factors include financial materiality, strategic importance, complexity, volume of transactions, degree of change, regulatory or legal exposure, reputational sensitivity, quality of the control environment, competence and stability of management, results of prior audits, time elapsed since last audit, fraud susceptibility, IT dependency, and management or board concern.
Inherent risk: The level of risk before considering controls. Residual risk: The level of risk remaining after controls are applied. Prioritization generally focuses on residual risk, but internal audit must apply skepticism because management's view of control effectiveness may be optimistic. Many methodologies therefore score inherent risk and then adjust for the perceived control environment, giving a residual view that still drives plan selection.
Risk appetite and tolerance: The amount of risk the organization is willing to accept. Areas where residual risk appears to exceed appetite are strong candidates for assurance.
Risk velocity: How quickly a risk could crystallize. Fast-moving risks (cyber, liquidity, regulatory deadlines) may deserve earlier scheduling even if their likelihood score is moderate.
Assurance mapping and combined assurance: A technique for identifying what assurance is already being provided by other parties (compliance, risk management, external audit, regulators, quality functions). Where reliable assurance exists elsewhere, internal audit may deprioritize or coordinate rather than duplicate.
Coverage cycle: The maximum interval at which an entity should be audited. High-risk entities may be annual, medium every two to three years, low every four to five years or not at all. Pure rotational (cycle-based) planning without risk input is considered outdated and will be the wrong answer on the exam when contrasted with risk-based selection.
How It Works: The Process Step by Step
Step 1 - Understand the organization and its objectives. The CAE gathers knowledge of strategy, business model, industry, regulatory environment, and emerging trends. Sources include the strategic plan, board papers, ERM risk register, prior audit results, external audit management letters, regulator correspondence, industry risk surveys, and interviews with executives and board members.
Step 2 - Define or refresh the audit universe. The universe is updated at least annually for new entities (acquisitions, new systems, new regulations, new products), retired entities, and structural changes. A universe that is stale will cause high-risk new areas to be missed entirely.
Step 3 - Select and weight risk factors. The function chooses a manageable set of factors (often five to ten) and assigns weights reflecting their relative importance. For example, strategic impact might carry a weight of 25 percent, financial materiality 20 percent, control environment 20 percent, change and complexity 15 percent, regulatory exposure 10 percent, and time since last audit 10 percent. Weights should be approved by the CAE and periodically revisited.
Step 4 - Score each entity. Each entity is rated on each factor using a defined scale (for example, 1 to 5). Scores are multiplied by weights and summed to give a composite risk score. Scoring should combine quantitative data (revenue, asset values, transaction volumes, loss history, number of findings) with qualitative judgment (management tone, culture, pace of change). Input should be obtained from management and the second line, but the final rating is internal audit's independent judgment.
Step 5 - Rank and tier. Entities are sorted by composite score and grouped into tiers (high, medium, low). Heat maps plotting likelihood against impact are a common visualization. Tiering translates into coverage frequency and engagement depth.
Step 6 - Apply overlays and judgment. Pure arithmetic is never the final answer. The CAE overlays: mandatory or regulatory audits (for example, required by a regulator or by contract), board and audit committee requests, management requests evaluated for appropriateness, emerging risks not yet in the universe, assurance already provided by others (assurance mapping), fraud risk considerations, and the need for some coverage of lower-risk areas to maintain deterrence and knowledge. Any adjustment to the score-driven ranking should be documented with a rationale.
Step 7 - Match to resources. The CAE estimates hours and skills required for each prioritized engagement and compares the total to available capacity. Where there is a gap, the CAE must either secure additional resources (co-sourcing, guest auditors, budget increase) or formally communicate the resulting coverage limitations and the risks that will not be reviewed. The Standards require that the CAE communicate the impact of resource limitations to senior management and the board.
Step 8 - Obtain approval and communicate. The plan, with its risk-based rationale, is presented to senior management for input and to the board (audit committee) for review and approval. The board should understand not only what will be audited but also what will not be audited and why.
Step 9 - Keep the plan dynamic. Risk changes continuously. Leading practice is a rolling or agile plan reviewed at least quarterly, with a portion of capacity (often 10 to 20 percent) held in reserve for emerging risks, special requests, and investigations. Significant changes to the plan should be communicated to and approved by the board.
Common Pitfalls in Practice
Relying solely on management's self-reported risk ratings. Letting the time-since-last-audit factor dominate so the plan becomes rotational in disguise. Failing to include strategic, IT, third-party, culture, and emerging risks in the universe. Treating the plan as fixed for twelve months. Scoring with false precision while ignoring judgment. Ignoring other assurance providers and duplicating effort. Not documenting why a high-scoring area was deferred.
Exam Tips: Answering Questions on Prioritizing Engagements by Risk
Tip 1 - Risk beats everything else as a selection basis. When a question asks what the audit plan should primarily be based on, the correct answer will reference the organization's risks, objectives, and risk assessment. Distractors will mention management requests, prior-year plans, auditor availability, rotation schedules, or budget convenience. Those can influence a plan but never form its primary basis.
Tip 2 - Distinguish inherent from residual risk. If a scenario describes an area with high inherent risk but strong, recently tested controls, the residual risk may be moderate and another area may rank higher. Conversely, if controls are reported as strong but have never been independently tested, internal audit should remain skeptical and may rate the area higher. Watch for the word reported or management believes, which signals unverified control reliance.
Tip 3 - Know what to do when resources are insufficient. The correct response is to communicate the resource constraint and the resulting uncovered risks to senior management and the board, and to seek approval for the coverage decision. Wrong answers include quietly dropping high-risk audits, reducing scope on every engagement without disclosure, or auditing only what fits the budget without informing governance bodies.
Tip 4 - Management requests are evaluated, not automatically accepted or rejected. A request from a senior executive should be assessed against the risk framework. If it is a high-risk area or a legitimate advisory need, it may be added; if it would displace a higher-risk engagement, the CAE should explain the trade-off to the board. The exam rewards balanced, risk-informed judgment rather than deference or rigidity.
Tip 5 - The plan must be dynamic. If a question describes a mid-year event (new acquisition, cyber incident, regulatory change, major system implementation), the best answer involves reassessing risk and adjusting the plan with board approval, not waiting for the next annual cycle.
Tip 6 - Board approval and communication are recurring themes. Any answer that bypasses the board on plan approval, significant plan changes, or communication of coverage gaps is almost certainly wrong.
Tip 7 - Recognize the role of other assurance providers. Questions about duplication of effort, assurance mapping, or combined assurance point to coordinating with and, where reliable, relying on the second line, external audit, or other providers. Internal audit still owns its own conclusions and must assess the reliability of any work relied upon.
Tip 8 - Watch for rotation-based distractors. An option that says every unit should be audited every three years regardless of risk is testing whether you recognize cycle-based planning as inferior to risk-based planning. Rotation can be a secondary consideration (for example, ensuring low-risk areas are not ignored forever), never the primary driver.
Tip 9 - Use the Three Lines Model lens. Internal audit prioritizes independently. It should use the ERM risk register as an input, but if the question implies that internal audit should simply adopt the second line's risk ratings without independent assessment, that option is wrong because it compromises independence and objectivity.
Tip 10 - Quantitative questions. If given a scoring table, carefully multiply each factor score by its weight, sum the results, and rank. Then check whether the question includes an overlay such as a regulatory mandate or a board request that changes the final order. Read the question stem twice to confirm whether it asks for the highest composite score or the first engagement to schedule, which may differ once overlays are applied.
Tip 11 - Think like a CAE, not a staff auditor. CRMA questions on planning are typically framed from the perspective of the CAE or audit leadership. Choose the answer that reflects professional judgment, documentation, transparency with governance, and alignment with organizational objectives.
Tip 12 - Eliminate extremes. Options containing words such as always, never, only, or regardless are frequently incorrect in planning questions because risk-based planning is inherently judgmental and contextual.
Quick Review Summary
Prioritizing engagements by risk means building a comprehensive audit universe, scoring each entity against weighted risk factors with a focus on residual risk and organizational objectives, ranking and tiering the results, applying documented judgment overlays (mandatory audits, board input, assurance mapping, emerging risks), matching the result to available resources, communicating gaps to the board, obtaining approval, and revisiting the plan continuously. On the exam, the correct answer will nearly always be the one that keeps risk and organizational objectives at the center, preserves internal audit independence, involves the board appropriately, and treats the plan as a living document.
Prioritizing engagements by risk is the heart of risk-based audit planning. It is the process by which the chief audit executive (CAE) decides which areas of the organization will receive internal audit attention, in what order, and with how much effort, based on the significance of the risks those areas pose to the achievement of organizational objectives. For the IIA Certification in Risk Management Assurance (CRMA) exam, this topic sits inside the domain on Risk-Based Audit Planning and Engagements, and it is tested heavily because it connects risk management concepts directly to the practical work of internal audit.
Why Prioritizing Engagements by Risk Is Important
Internal audit functions never have enough resources to audit everything. A typical audit universe may contain hundreds of auditable entities (processes, business units, systems, projects, locations, compliance obligations), yet the audit plan might support only thirty to sixty engagements a year. Without a disciplined, risk-based method of choosing, the function would default to habit, convenience, or whoever shouts loudest. Risk-based prioritization matters for several reasons:
1. Alignment with the Standards. The IIA Global Internal Audit Standards (effective January 2025) require the CAE to develop an internal audit plan that is based on a documented assessment of the organization's strategies, objectives, and risks (Standard 9.4, Internal Audit Plan), informed by an understanding of governance, risk management, and control processes (Standard 9.1). The predecessor 2017 Standard 2010 (Planning) carried the same requirement. Examiners expect you to know that risk-based planning is mandatory, not optional.
2. Value to the board and senior management. The board wants assurance over the risks that could actually prevent the organization from achieving its strategy. Prioritizing by risk ensures audit effort is spent where failure would hurt the most, giving the board meaningful rather than cosmetic assurance.
3. Efficient use of scarce resources. Risk-based prioritization lets the CAE justify staffing, budget, and skill mix decisions and defend why certain areas were deferred.
4. Defensibility. If a significant failure occurs in an unaudited area, a documented risk-based rationale protects the credibility of the function. If a failure occurs in an area that was ranked low, the methodology can be examined and improved.
5. Linkage to enterprise risk management (ERM). A mature risk-based plan draws on the organization's own risk assessment, risk appetite, and risk register, creating coherence between the second line (risk management) and third line (internal audit) under the IIA Three Lines Model.
What Prioritizing Engagements by Risk Is
At its core, prioritization is a ranking exercise. The CAE and audit leadership take the full population of things that could be audited (the audit universe), assess each item against a consistent set of risk criteria, and then rank or tier them so that the highest-risk items are scheduled first, most frequently, and with the deepest scope. Lower-risk items are scheduled less often, covered through lighter-touch methods (continuous monitoring, self-assessment, reliance on other assurance providers), or consciously excluded with the board's awareness.
Key vocabulary you must know for the exam:
Audit universe: The complete inventory of auditable entities. It should be built from multiple lenses: organizational structure, business processes, strategic objectives, key risks, systems, regulatory obligations, and major projects or change initiatives.
Auditable entity (or auditable unit): A discrete item in the audit universe that can be scoped as an engagement.
Risk factors (or risk criteria): The attributes used to score each entity. Common factors include financial materiality, strategic importance, complexity, volume of transactions, degree of change, regulatory or legal exposure, reputational sensitivity, quality of the control environment, competence and stability of management, results of prior audits, time elapsed since last audit, fraud susceptibility, IT dependency, and management or board concern.
Inherent risk: The level of risk before considering controls. Residual risk: The level of risk remaining after controls are applied. Prioritization generally focuses on residual risk, but internal audit must apply skepticism because management's view of control effectiveness may be optimistic. Many methodologies therefore score inherent risk and then adjust for the perceived control environment, giving a residual view that still drives plan selection.
Risk appetite and tolerance: The amount of risk the organization is willing to accept. Areas where residual risk appears to exceed appetite are strong candidates for assurance.
Risk velocity: How quickly a risk could crystallize. Fast-moving risks (cyber, liquidity, regulatory deadlines) may deserve earlier scheduling even if their likelihood score is moderate.
Assurance mapping and combined assurance: A technique for identifying what assurance is already being provided by other parties (compliance, risk management, external audit, regulators, quality functions). Where reliable assurance exists elsewhere, internal audit may deprioritize or coordinate rather than duplicate.
Coverage cycle: The maximum interval at which an entity should be audited. High-risk entities may be annual, medium every two to three years, low every four to five years or not at all. Pure rotational (cycle-based) planning without risk input is considered outdated and will be the wrong answer on the exam when contrasted with risk-based selection.
How It Works: The Process Step by Step
Step 1 - Understand the organization and its objectives. The CAE gathers knowledge of strategy, business model, industry, regulatory environment, and emerging trends. Sources include the strategic plan, board papers, ERM risk register, prior audit results, external audit management letters, regulator correspondence, industry risk surveys, and interviews with executives and board members.
Step 2 - Define or refresh the audit universe. The universe is updated at least annually for new entities (acquisitions, new systems, new regulations, new products), retired entities, and structural changes. A universe that is stale will cause high-risk new areas to be missed entirely.
Step 3 - Select and weight risk factors. The function chooses a manageable set of factors (often five to ten) and assigns weights reflecting their relative importance. For example, strategic impact might carry a weight of 25 percent, financial materiality 20 percent, control environment 20 percent, change and complexity 15 percent, regulatory exposure 10 percent, and time since last audit 10 percent. Weights should be approved by the CAE and periodically revisited.
Step 4 - Score each entity. Each entity is rated on each factor using a defined scale (for example, 1 to 5). Scores are multiplied by weights and summed to give a composite risk score. Scoring should combine quantitative data (revenue, asset values, transaction volumes, loss history, number of findings) with qualitative judgment (management tone, culture, pace of change). Input should be obtained from management and the second line, but the final rating is internal audit's independent judgment.
Step 5 - Rank and tier. Entities are sorted by composite score and grouped into tiers (high, medium, low). Heat maps plotting likelihood against impact are a common visualization. Tiering translates into coverage frequency and engagement depth.
Step 6 - Apply overlays and judgment. Pure arithmetic is never the final answer. The CAE overlays: mandatory or regulatory audits (for example, required by a regulator or by contract), board and audit committee requests, management requests evaluated for appropriateness, emerging risks not yet in the universe, assurance already provided by others (assurance mapping), fraud risk considerations, and the need for some coverage of lower-risk areas to maintain deterrence and knowledge. Any adjustment to the score-driven ranking should be documented with a rationale.
Step 7 - Match to resources. The CAE estimates hours and skills required for each prioritized engagement and compares the total to available capacity. Where there is a gap, the CAE must either secure additional resources (co-sourcing, guest auditors, budget increase) or formally communicate the resulting coverage limitations and the risks that will not be reviewed. The Standards require that the CAE communicate the impact of resource limitations to senior management and the board.
Step 8 - Obtain approval and communicate. The plan, with its risk-based rationale, is presented to senior management for input and to the board (audit committee) for review and approval. The board should understand not only what will be audited but also what will not be audited and why.
Step 9 - Keep the plan dynamic. Risk changes continuously. Leading practice is a rolling or agile plan reviewed at least quarterly, with a portion of capacity (often 10 to 20 percent) held in reserve for emerging risks, special requests, and investigations. Significant changes to the plan should be communicated to and approved by the board.
Common Pitfalls in Practice
Relying solely on management's self-reported risk ratings. Letting the time-since-last-audit factor dominate so the plan becomes rotational in disguise. Failing to include strategic, IT, third-party, culture, and emerging risks in the universe. Treating the plan as fixed for twelve months. Scoring with false precision while ignoring judgment. Ignoring other assurance providers and duplicating effort. Not documenting why a high-scoring area was deferred.
Exam Tips: Answering Questions on Prioritizing Engagements by Risk
Tip 1 - Risk beats everything else as a selection basis. When a question asks what the audit plan should primarily be based on, the correct answer will reference the organization's risks, objectives, and risk assessment. Distractors will mention management requests, prior-year plans, auditor availability, rotation schedules, or budget convenience. Those can influence a plan but never form its primary basis.
Tip 2 - Distinguish inherent from residual risk. If a scenario describes an area with high inherent risk but strong, recently tested controls, the residual risk may be moderate and another area may rank higher. Conversely, if controls are reported as strong but have never been independently tested, internal audit should remain skeptical and may rate the area higher. Watch for the word reported or management believes, which signals unverified control reliance.
Tip 3 - Know what to do when resources are insufficient. The correct response is to communicate the resource constraint and the resulting uncovered risks to senior management and the board, and to seek approval for the coverage decision. Wrong answers include quietly dropping high-risk audits, reducing scope on every engagement without disclosure, or auditing only what fits the budget without informing governance bodies.
Tip 4 - Management requests are evaluated, not automatically accepted or rejected. A request from a senior executive should be assessed against the risk framework. If it is a high-risk area or a legitimate advisory need, it may be added; if it would displace a higher-risk engagement, the CAE should explain the trade-off to the board. The exam rewards balanced, risk-informed judgment rather than deference or rigidity.
Tip 5 - The plan must be dynamic. If a question describes a mid-year event (new acquisition, cyber incident, regulatory change, major system implementation), the best answer involves reassessing risk and adjusting the plan with board approval, not waiting for the next annual cycle.
Tip 6 - Board approval and communication are recurring themes. Any answer that bypasses the board on plan approval, significant plan changes, or communication of coverage gaps is almost certainly wrong.
Tip 7 - Recognize the role of other assurance providers. Questions about duplication of effort, assurance mapping, or combined assurance point to coordinating with and, where reliable, relying on the second line, external audit, or other providers. Internal audit still owns its own conclusions and must assess the reliability of any work relied upon.
Tip 8 - Watch for rotation-based distractors. An option that says every unit should be audited every three years regardless of risk is testing whether you recognize cycle-based planning as inferior to risk-based planning. Rotation can be a secondary consideration (for example, ensuring low-risk areas are not ignored forever), never the primary driver.
Tip 9 - Use the Three Lines Model lens. Internal audit prioritizes independently. It should use the ERM risk register as an input, but if the question implies that internal audit should simply adopt the second line's risk ratings without independent assessment, that option is wrong because it compromises independence and objectivity.
Tip 10 - Quantitative questions. If given a scoring table, carefully multiply each factor score by its weight, sum the results, and rank. Then check whether the question includes an overlay such as a regulatory mandate or a board request that changes the final order. Read the question stem twice to confirm whether it asks for the highest composite score or the first engagement to schedule, which may differ once overlays are applied.
Tip 11 - Think like a CAE, not a staff auditor. CRMA questions on planning are typically framed from the perspective of the CAE or audit leadership. Choose the answer that reflects professional judgment, documentation, transparency with governance, and alignment with organizational objectives.
Tip 12 - Eliminate extremes. Options containing words such as always, never, only, or regardless are frequently incorrect in planning questions because risk-based planning is inherently judgmental and contextual.
Quick Review Summary
Prioritizing engagements by risk means building a comprehensive audit universe, scoring each entity against weighted risk factors with a focus on residual risk and organizational objectives, ranking and tiering the results, applying documented judgment overlays (mandatory audits, board input, assurance mapping, emerging risks), matching the result to available resources, communicating gaps to the board, obtaining approval, and revisiting the plan continuously. On the exam, the correct answer will nearly always be the one that keeps risk and organizational objectives at the center, preserves internal audit independence, involves the board appropriately, and treats the plan as a living document.
Test mode:
CRMA - Prioritizing Engagements by Risk Example Questions
Test your knowledge of Prioritizing Engagements by Risk
Question 1
Midyear, an organization speeds up a core system migration. The updated organizationwide risk assessment now rates the migration above every remaining engagement in the approved risk-based internal audit plan. The internal audit function has no spare capacity. One remaining engagement covers a stable, low-risk expense process that received clean results in its last two audits. Which action should the chief audit executive take?
Question 2
A chief audit executive reviews a draft risk-based internal audit plan. Staff ranked auditable units using organizationwide risk assessment scores. They then applied a rule that defers any unit audited within the past three years. As a result, a unit that completed a major acquisition last quarter, and now carries the second-highest residual risk score, is deferred. Several moderate-risk units that are overdue for rotation are included instead. All available hours are allocated. Which weakness in the prioritization approach should the chief audit executive address FIRST?
Question 3
An organizationwide risk assessment shows two units competing for the last open engagement slot in the risk-based internal audit plan. Unit A has the highest inherent risk score. Its compliance function tests key controls quarterly, and internal audit has evaluated that function's competence, objectivity and work quality as reliable. Unit B has a slightly lower inherent score, recently replaced its core processing system and receives no assurance from any other provider. Which conclusion should MOST influence the chief audit executive's prioritization?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2615 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Prioritizing Engagements by Risk questions
18 questions (total)
Other Risk-Based Audit Planning and Engagements concepts
Aggregating Results Across EngagementsAudit Plan Approval and Resource CommunicationDeveloping Staff Through EngagementsDeveloping the Risk-Based Internal Audit PlanEngagement Objectives and Scope for Risk EngagementsEngagement SupervisionEngagement Work ProgramsEvaluating Management's Risk RemediationForming an Overall Assessment of Risk ManagementManagement Requests in the Audit PlanManaging Engagement Resources and TimelinesMarket and Industry Trends as Sources of RiskOrganizationwide Risk Assessment for Audit PlanningQuality Assurance in EngagementsRegulatory Change as a Source of RiskThe Audit UniverseUpdating the Audit Plan for Changing RisksUsing Management's Risk Assessment in PlanningUsing Other Providers' Work in an Overall Assessment