Which of the following applications has the MOST inherent risk and should be prioritized during audit planning?

Internally developed applications often have higher inherent risk because they may not have undergone rigorous testing, external validation, or established security reviews compared to commercial products, leading to potential vulnerabilities or control weaknesses. The development process itself might lack standardized security practices, increasing the likelihood of design flaws or coding errors that introduce risk.

An unsupported onsite application certainly has high risk due to lack of patches and updates, but an internally developed application has inherent risks from its inception, encompassing design, development, and testing phases.

A decommissioned legacy application poses less inherent risk to current operations than an actively used application, as it is no longer processing live data, though data retention risks might exist.

An outsourced accounting application, while critical, benefits from the vendor's specialized controls, audits, and mature development lifecycle, potentially reducing its inherent risk compared to a bespoke, internally built solution.