Which of the following should be the PRIMARY basis for prioritizing follow-up audits?

An audit cycle defines regular audits but doesn't specifically prioritize follow-up on critical findings based on their risk level.

While executive management recommendations are important, risk-based prioritization ensures objectivity and alignment with the most significant organizational exposures, rather than subjective input.

Follow-up audits are conducted to verify that management has implemented corrective actions for identified deficiencies and to assess whether these actions have effectively mitigated the associated risks. Prioritizing based on residual risk ensures that areas with the greatest potential impact or likelihood of harm to the organization are re-evaluated promptly, aligning audit efforts with the organization's overall risk management strategy.

The complexity of management's action plans might influence scheduling but should not be the primary factor for prioritizing the audit itself, which should fundamentally focus on risk reduction.