What is the PRIMARY reason to adopt a risk-based IS audit strategy?

Achieving synergy with other risk management functions is a beneficial outcome, but not the primary driving reason for adopting a risk-based audit strategy itself, which is resource prioritization.

While a risk-based approach might reduce effort on low-risk areas, its main goal is effective risk mitigation and resource optimization, not merely reducing overall audit time.

A risk-based IS audit strategy primarily aims to optimize the use of limited audit resources by directing them towards areas and systems that pose the greatest risk to the organization's objectives, assets, and information. By focusing on significant risks, auditors can ensure that the most critical vulnerabilities are identified and addressed, providing the most value to the organization.

Identifying key threats, risks, and controls is a necessary prerequisite step in conducting a risk assessment, which then informs the adoption and implementation of a risk-based audit strategy, rather than being the strategy's primary reason for adoption.