Risk-Based Audit Planning

CISA aspirants are expected to understand the following aspects of risk-based audit planning:

• What is risk?
• Vulnerabilities and threats
• Inherent risk and residual risk
• The advantages of risk-based audit planning
• Audit risk
• The steps of the risk-based audit approach
• The steps of risk assessment
• The four methodologies for risk treatment

What Is Risk?

You will now explore some of the widely accepted definitions of risk.

Most of the CISA questions are framed around risk. Therefore, CISA candidates should have a thorough understanding of the term risk, which has multiple definitions/formulas. If you look carefully, every definition speaks either directly or indirectly about two terms: probability and impact.

Some of the more commonly used definitions of risk are presented here:

• COSO ERM defines risk as “potential events that may impact the entity.”
• The Oxford English Dictionary defines...