Which of the following is the GREATEST concern associated with IS risk-based auditing when audit resources are limited?

Question

Options

• AThere may be significant delays in responding to management audit requests
• BSome business processes may not be audited
• CConducting risk assessments may reduce the time available for auditing
• DThe audit schedule may become too predictable

• A
  7% (3)
• B
  88% (37)
• C
  2% (1)
• D
  2% (1)

Explanation

Why B is correct: Risk-based auditing allocates limited audit resources to areas with the highest assessed risk, which means lower-risk business processes may receive no audit coverage at all. This creates a genuine governance gap - entire areas of the organization go unexamined, potentially allowing undetected errors, fraud, or control failures to persist.

Why the distractors are wrong:

• A is a concern in any resource-constrained environment, not specific to risk-based auditing - and responding to management requests is a scheduling issue, not a structural blind spot.
• C is backwards in its logic: risk assessments are precisely what enable efficient use of limited time, so they reduce wasted effort rather than competing with auditing.
• D describes a concern with scheduled/cyclical auditing, not risk-based auditing - risk-based schedules are actually less predictable because they shift with the risk landscape.

Memory tip: Think of risk-based auditing as a spotlight - it illuminates the riskiest areas brilliantly, but anything outside the beam stays in the dark. When resources are limited, the beam gets narrower, and more of the room goes unseen. The greatest concern is always what's not being looked at.

No community discussion yet for this question.