Risk drives everything

Exam

CISA & CISM

What it means

Plans, control selection, testing scope and remediation priorities should all follow risk. When asked what to do first, a risk assessment or understanding the risk is often the answer.

The trap answer looks like

Test everything equally, audit what was skipped last year, or fix the easiest issues first.

The winning answer looks like

Prioritize by risk: likelihood and impact on what matters most to the business.

Worked example

An audit manager is preparing the annual plan. What first?

✅ Assess the risks to key business processes and systems

Risk assessment comes before scheduling, staffing or procedures.