Prioritizing the Audit Plan Based on Risk
Ordering audits by exposure, not by turn
When an organization has dozens of systems and processes that could be audited but only the capacity to review a fraction of them each year, the annual audit plan must be prioritized according to the relative risk of each element and not by an arbitrary criterion such as alphabetical order or area availability. This is achieved by building an audit universe that lists all auditable processes and systems, and assigning them a risk score based on factors such as the time since the last review, the asset's criticality, recent changes in the environment and historical findings. In practice, this plan must be reviewed and adjusted periodically, because risk isn't static: a system considered low priority can escalate at any moment if a critical vulnerability is detected in its underlying technology or if its exposure changes after a cloud migration.