6. Risk-Based Audit Program Design and Governance

Introduction: From Audit Calendar to Strategic Assurance

An audit programme is more than a timetable of audits. It is a structured governance instrument through which an organisation obtains assurance that its quality management system, operational controls, regulatory arrangements, and improvement processes are capable of achieving intended results. In a traditional compliance-oriented model, audits are often scheduled at fixed intervals: each department is audited once or twice a year, previous checklists are reused, and findings are reported after the event. Such an approach may demonstrate activity, but it does not necessarily provide assurance over the issues that matter most.

Risk-based audit programme design changes the central question. Instead of asking, “Which department is due for an audit?” management asks, “Which risks could most seriously affect customers, compliance, business continuity, product conformity, or strategic objectives, and what evidence is needed to assess their control?” The audit programme is consequently linked to organisational context, interested-party expectations, process performance, previous audit results, changes in technology or regulation, and the consequences of failure.

This perspective is consistent with the risk-based thinking embedded in modern quality management systems, including ISO 9001:2015. It is also relevant to internal auditing, supplier auditing, regulatory inspection, information security, environmental management, medical devices, aerospace, financial services, and integrated management systems. A well-governed programme balances assurance, improvement, independence, resource constraints, and management accountability.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the purpose, components, and governance significance of a risk-based audit programme.

2. Distinguish an audit programme from an individual audit plan.

3. Identify and prioritise audit subjects using risk, performance, change, and assurance considerations.

4. Define appropriate audit objectives, scope, criteria, frequency, methods, resources, and responsibilities.

5. Design escalation and reporting arrangements that support timely managerial action.

6. Map audit coverage to organisational risks, controls, processes, and other assurance providers.

7. Evaluate independence, competence, ethics, technology, and limitations in audit programme management.

8. Apply the principles through a practical case involving a quality-critical organisation.

The Audit Programme as a Governance System

An audit programme is a set of one or more audits planned for a specified period and directed towards a defined purpose. It includes the audits themselves, but also the decisions that determine why audits are conducted, what they cover, who performs them, how results are evaluated, and how follow-up is governed. An individual audit plan, by contrast, describes the arrangements for one particular audit, such as its dates, locations, team members, activities, and interviews.

The distinction is strategically important. A single audit may be technically competent yet fail to address the organisation’s most significant exposure. Programme management prevents isolated audits from becoming disconnected exercises. It establishes a portfolio view: high-risk processes may require frequent or deeper audits; stable, low-risk activities may be reviewed less often; and emerging risks may justify a special audit outside the annual schedule.

A mature programme normally connects five layers of organisational information:

• strategic objectives and stakeholder expectations;
• risks, opportunities, and legal or contractual obligations;
• processes, controls, and performance indicators;
• prior audit results, incidents, complaints, and corrective actions; and
• available assurance from internal audit, certification bodies, regulators, customers, and technical reviews.

Governance exists when authority, accountability, decision rights, reporting channels, and escalation rules are explicit. The audit programme owner may be a quality director, chief audit executive, compliance leader, or another designated manager. Operational managers remain responsible for their processes and corrective actions; auditors provide evidence-based evaluation, not management of the activities they audit.

A Risk-Based Architecture for Programme Design

Risk-based design should not reduce auditing to a numerical score. A risk rating is a decision aid, not a substitute for professional judgement. A useful programme begins by identifying audit entities: processes, sites, products, projects, suppliers, information systems, regulatory obligations, or cross-functional themes. Each entity is then considered in relation to risk and assurance needs.

Understanding audit risk and organisational risk

Organisational risk is the effect of uncertainty on objectives. In quality work, this may involve nonconforming product, unsafe service, unreliable data, customer dissatisfaction, regulatory breach, supply disruption, or failure to achieve process targets. Audit risk is different: it is the possibility that the audit conclusion is inappropriate because significant issues were not detected, evidence was insufficient, or findings were misunderstood.

The audit programme should respond to organisational risk while managing audit risk. For example, a high-volume production line with recurring customer complaints deserves priority because the consequence and likelihood of failure are material. However, the audit team must also consider whether it has the technical competence and access to reliable data needed to audit the process effectively.

Risk-prioritisation criteria

A practical prioritisation model may consider:

1. Impact or consequence: potential effect on safety, conformity, customers, reputation, finances, legal compliance, or continuity.

2. Likelihood: probability that an undesired event or control failure will occur.

3. Control maturity: reliability, consistency, and demonstrated effectiveness of existing controls.

4. Performance signals: trends in defects, complaints, rework, late delivery, incidents, audit findings, or key performance indicators.

5. Change: new products, suppliers, sites, software, equipment, processes, leadership, regulations, or organisational restructuring.

6. Criticality and complexity: dependence on specialised knowledge, multiple interfaces, outsourced activities, or difficult-to-verify controls.

7. Assurance gap: absence, weakness, age, or duplication of other assurance activities.

A simple risk score can be useful for screening, but thresholds should be documented. A process with a moderate numerical score may still require immediate attention if it involves a legal obligation or a serious customer complaint. Conversely, frequent audits of a low-risk area may waste resources and encourage procedural compliance without meaningful assurance.

Risk appetite and audit intensity

Risk appetite expresses the level and type of risk an organisation is willing to accept in pursuit of objectives. Audit intensity should reflect this context. Audit intensity can vary through frequency, duration, sample size, technical depth, auditor seniority, use of specialists, geographic coverage, and follow-up requirements. High intensity is not automatically better. It is justified when the expected value of additional assurance exceeds its cost and operational disruption.

Defining the Audit Proposition

Each audit should have a clear proposition: what management needs to know and what evidence will support the conclusion. Four elements provide the foundation.

Objectives

Objectives state the intended purpose of the audit. They may include evaluating conformity with specified requirements, determining whether controls are designed and implemented effectively, assessing process performance, verifying corrective action, or identifying improvement opportunities. Objectives should be specific enough to guide evidence collection but not so narrow that material issues are excluded.

For example, “audit the purchasing department” is weak. “Determine whether supplier selection, monitoring, and incoming verification controls are adequate to ensure conformity of critical purchased components” is more useful because it identifies the risk and expected result.

Scope

Scope defines boundaries. It may specify sites, functions, products, processes, shifts, systems, time periods, suppliers, or organisational units. Scope must be realistic and transparent. An audit that claims enterprise-wide coverage but examines one location creates false assurance. Exclusions should be justified and communicated, particularly when they affect the interpretation of results.

Criteria

Criteria are the requirements against which evidence is evaluated. They may include ISO standards, organisational policies, procedures, contractual terms, laws, specifications, customer requirements, risk controls, and approved performance targets. Criteria should be current, accessible, and relevant. Auditors should distinguish mandatory requirements from guidance and should not treat undocumented personal preferences as criteria.

Methods and evidence

Audit methods may include document review, interviews, observation, data analysis, sampling, tracing a transaction or product through a process, remote assessment, and testing of control operation. The method should match the risk. A high-risk electronic approval control may require system-log testing rather than a discussion with the process owner. Evidence should be sufficient, appropriate, traceable, and evaluated against criteria rather than against the auditor’s expectations.

Frequency, Timing, and Programme Flexibility

Frequency is a managerial decision informed by risk, performance, change, and prior assurance. A fixed annual cycle is easy to administer but can be misleading. A risk-based programme may use a combination of:

• scheduled periodic audits for essential processes;
• event-driven audits following incidents, complaints, major changes, or serious findings;
• thematic audits across several processes, such as competence or data integrity;
• follow-up audits to verify corrective action; and
• continuous or near-real-time monitoring for selected controls.

Frequency should be reviewed when risk conditions change. A process with repeated major nonconformities should not simply wait for its next scheduled date. Similarly, a process demonstrating sustained control effectiveness may be audited through lighter-touch methods, provided the decision is documented and does not conflict with external or contractual requirements.

Programme flexibility requires a change-control mechanism. Changes to the schedule should record the reason, risk implication, revised timing, responsible decision-maker, and any compensating assurance. Without such discipline, urgent operational demands may continually displace difficult audits.

Resources, Competence, and Independence

The programme owner must secure adequate resources in terms of people, time, budget, specialist knowledge, travel, data access, translation, and audit technology. Resource planning should consider the total effort, including preparation, fieldwork, reporting, corrective-action review, and programme evaluation.

Competence includes knowledge of audit principles, applicable standards, risk assessment, interviewing, evidence evaluation, report writing, and the technical subject being examined. Technical specialists may be necessary in areas such as validation, cybersecurity, statistical process control, clinical practice, or engineering. A specialist can provide knowledge without taking over the auditor’s responsibility for forming an objective conclusion.

Independence and objectivity require freedom from conflicts of interest, undue influence, and self-review. Auditors should not audit work for which they have direct operational responsibility or recently made key decisions. In small organisations, complete separation may be difficult; safeguards can include cross-functional auditing, external auditors, supervisory review, rotation, and disclosure of conflicts. Independence is not merely an organisational chart issue. An auditor may formally report to an independent function yet still be pressured to soften findings.

Confidentiality, impartiality, professional scepticism, due care, and evidence-based judgement are ethical foundations. Auditors should protect personal, commercial, and security-sensitive information, while retaining records sufficient to support conclusions.

Governance, Escalation, and Executive Oversight

A programme becomes effective when findings lead to decisions. Governance arrangements should define who approves the programme, receives reports, accepts residual risk, allocates corrective-action resources, and determines escalation.

A useful reporting hierarchy includes operational reporting to process owners, periodic reporting to quality or risk committees, and consolidated reporting to executive management or the governing body. Reports should communicate significance, not merely counts. The number of findings can be less informative than the recurrence of a systemic weakness, the age of overdue actions, or the concentration of risk in one supplier or process.

Escalation criteria may include:

• actual or potential serious harm to customers, users, employees, or the environment;
• breach of law, regulation, licence, or contractual obligation;
• suspected fraud, deliberate concealment, or data manipulation;
• repeated or overdue corrective actions;
• failure of a critical control;
• disagreement that prevents an appropriate conclusion; and
• inability to obtain reliable evidence.

Escalation should be timely and proportionate. It should not be used as a disciplinary weapon or to bypass fair fact-checking. Auditees should have an opportunity to clarify evidence, but management must not delay urgent communication while seeking perfect agreement on wording.

Executive oversight should examine whether the programme is aligned with strategy, whether resources are sufficient, whether important risks remain outside coverage, and whether audit results are producing improvement. Oversight bodies should challenge both complacency and audit overreach. They should ask whether the programme provides useful assurance or merely demonstrates that audits occurred.

Assurance Mapping and Avoiding Blind Spots

Assurance mapping places audit activity within the wider system of risk oversight. Management controls and operational supervision are the first line. Specialist risk, quality, compliance, and safety functions often provide the second line through monitoring, reviews, and guidance. Internal audit or an equivalent independent function provides a third-line evaluation. External certification, regulatory inspection, customer audits, and independent assessments add external perspectives.

The lines model is not a rigid organisational design. Its value lies in clarifying accountability and identifying gaps or duplication. An assurance map may list key risks, responsible controls, assurance providers, frequency, scope, recent results, and residual gaps. If three providers review document control while no one evaluates supplier cybersecurity, the map reveals an imbalance.

Coordination should preserve independence. Sharing plans and results can reduce duplication, but one assurance provider should not simply rely on another without evaluating competence, scope, methods, evidence, and objectivity. Reliance must be explicit and justified.

From Programme to Individual Audit: A Controlled Workflow

Programme design is translated into practice through a sequence of linked decisions.

First, the programme owner establishes the audit universe and updates the risk and assurance profile. Second, priorities are selected and programme objectives are approved. Third, resources, competence, timing, and independence are confirmed. Fourth, each audit receives a detailed plan identifying objectives, scope, criteria, methods, team roles, logistics, and communication arrangements.

During the audit, the team conducts an opening discussion, gathers and evaluates evidence, records working papers, and communicates significant issues promptly. Sampling should be risk-based and defensible. Auditors should follow evidence across functional boundaries rather than stopping at departmental responsibility. A nonconformity in final inspection may originate in design, purchasing, training, or maintenance.

After fieldwork, findings are evaluated for factual accuracy, requirement linkage, significance, and systemic implications. The report should distinguish nonconformity, observation, opportunity for improvement, and positive practice where the organisation uses those categories. Process owners should analyse causes and propose corrective actions; auditors evaluate adequacy and later verify implementation and effectiveness.

Finally, the programme owner analyses themes across audits. Recurrence, common causes, delayed actions, and emerging patterns are more valuable than treating every finding as an isolated event.

Digital Tools, Analytics, and Remote Auditing

Digital systems can improve programme visibility and traceability. Audit-management platforms may integrate risk registers, audit schedules, criteria libraries, findings, action owners, due dates, evidence, approvals, and dashboards. Data analytics can identify unusual transactions, defect clusters, repeated overrides, supplier trends, or control failures that merit targeted testing.

Remote auditing can be effective where records, interviews, system demonstrations, and observation are accessible through secure technology. It is less suitable where physical conditions, tacit practices, material handling, or safety behaviour are central to the audit. Remote methods require attention to identity verification, confidentiality, connectivity, time zones, data integrity, and the possibility that the auditee presents a curated view.

Artificial intelligence may assist with document classification, trend detection, sampling suggestions, transcription, and draft analysis. It should not replace professional judgement. AI-generated summaries can omit context, reproduce biased data, expose confidential information, or create unsupported conclusions. Human auditors must validate outputs, preserve evidence, explain decisions, and comply with information-governance requirements.

Applied Case: A Risk-Based Programme in a Medical-Device Manufacturer

Background

This illustrative case concerns Meditron Components, a fictional manufacturer of sterile components supplied to medical-device producers. Its quality management system is certified, and the organisation has historically audited every department annually using a standard checklist.

Situation and problem

Customer complaints about particulate contamination increased over two quarters. At the same time, a new automated cleaning system was introduced, two critical cleaning chemicals were sourced from a new supplier, and several experienced technicians left. The annual audit schedule still allocated equal time to administration, training records, purchasing, production, and maintenance. The quality manager recognised that the programme was active but not risk-responsive.

Analysis

The audit team reviewed complaint data, process capability information, supplier performance, change-control records, training data, and previous findings. It identified an assurance gap: no integrated audit had examined the relationship between chemical specifications, equipment validation, operator competence, environmental monitoring, and final inspection. Previous audits had examined these areas separately and had not traced contamination risks across process boundaries.

The team rated contamination control as high priority because the potential customer and regulatory consequences were serious, the complaint trend was adverse, and several changes had occurred simultaneously. It also identified audit risk: the team lacked a specialist familiar with automated cleaning validation.

Approach and solution

The revised programme included a focused, cross-functional audit with the following objective: determine whether controls governing cleaning validation, chemical conformity, operator competence, environmental conditions, and contamination detection were designed and operating effectively.

The scope covered the new cleaning system, relevant suppliers, production shifts, maintenance records, training, environmental monitoring, and complaint escalation. Criteria included applicable quality-system requirements, approved specifications, validation protocols, work instructions, customer requirements, and internal performance targets. A validation specialist from another site joined the team, and an independent auditor reviewed the final conclusions.

The audit used process tracing rather than departmental sampling alone. The team selected complaint-linked batches, followed records from incoming chemicals through production, observed cleaning operations on different shifts, examined system alarms and maintenance data, interviewed operators, and tested whether deviations were investigated. The programme also added a short-term follow-up audit and monthly management review of contamination indicators.

Outcome

The audit found that the cleaning equipment had been installed according to the approved change plan, but validation evidence did not cover the full operating range used on a night shift. One chemical supplier had changed a formulation without adequate notification, and refresher training did not address the new alarm logic. These issues were escalated because they could affect product conformity. Management introduced additional validation tests, strengthened supplier-change notification requirements, revised training, and increased environmental sampling until effectiveness was demonstrated.

The programme owner also changed the annual model. High-risk processes would receive event-driven and periodic audits, while low-risk administrative processes would use a lighter review cycle. The assurance map was updated to show responsibilities for validation, supplier monitoring, and complaint trend analysis.

Learning points

The case demonstrates that equal audit frequency does not create equal assurance. Risk was revealed through the interaction of change, supplier dependence, competence, equipment, and complaints. Cross-functional scope was essential. Specialist competence and independent review protected audit quality. Finally, programme governance ensured that findings altered resource allocation and future audit coverage rather than remaining as a report.

Challenges, Limitations, and Common Mistakes

Risk-based auditing involves judgement and therefore cannot eliminate subjectivity. Risk registers may be incomplete, performance data may be unreliable, and managers may understate emerging threats. Quantitative scoring can create false precision, especially when likelihood and consequence estimates are based on limited evidence.

Common mistakes include auditing what is easy to access rather than what is important; treating checklist completion as assurance; ignoring interfaces between processes; using outdated criteria; scheduling audits without considering change; allowing operational pressure to cancel high-risk work; and closing corrective actions after implementation without testing effectiveness. Another mistake is confusing a large number of findings with a high-quality audit. Excessive minor observations may obscure one systemic weakness.

Auditees may become defensive when findings affect performance evaluations or budgets. Auditors should therefore use clear criteria, respectful communication, triangulation of evidence, and fair opportunity for response. Management, in turn, must protect auditors from retaliation and must not reward the suppression of bad news.

The programme also has limitations. It provides sampled assurance, not certainty. Audits are periodic and may miss events between reviews. Controls may work during an audit but fail under unusual conditions. Independent assurance cannot replace competent management control. These limitations should be stated when reporting significant conclusions.

Current Developments and Best-Practice Principles

Contemporary programmes increasingly combine periodic audits with continuous monitoring, risk sensing, supplier ecosystem analysis, and integrated assurance. Climate-related disruption, cyber-physical systems, artificial intelligence, complex outsourcing, and rapidly changing regulation are expanding the audit universe. Quality auditors increasingly need competence in data governance, resilience, information security, and sustainability-related claims where these affect conformity and stakeholder trust.

Effective practice can be summarised in several principles:

• begin with objectives, risks, and decisions rather than with a calendar;
• maintain a current audit universe and assurance map;
• vary frequency and depth according to risk and evidence;
• define objectives, scope, criteria, methods, and escalation before fieldwork;
• match auditor competence to technical complexity;
• protect independence while enabling constructive engagement;
• use data to identify patterns, but validate data quality and interpretation;
• report significance, systemic causes, and residual risk, not only finding counts;
• verify corrective-action effectiveness; and
• have executives review whether the programme changes outcomes and supports strategy.

Chapter Summary

A risk-based audit programme is a governance mechanism that directs assurance toward risks capable of affecting strategic objectives, customers, conformity, compliance, and organisational performance. It differs from an individual audit plan because it manages a portfolio of audits and establishes priorities, resources, responsibilities, methods, reporting, and follow-up.

Effective design begins with an audit universe and an informed assessment of impact, likelihood, control maturity, performance, change, complexity, and assurance gaps. Each audit requires clear objectives, scope, criteria, frequency, methods, competent resources, and independence. Governance arrangements determine approval, escalation, corrective-action accountability, and executive oversight. Assurance mapping helps identify blind spots and unnecessary duplication across management, specialist, internal, external, and regulatory assurance.

Digital tools, analytics, remote auditing, and AI can strengthen programme visibility and risk detection, but they require human judgement, data governance, security, and professional accountability. The central managerial test is not whether audits occurred, but whether the programme produced credible assurance and enabled timely improvement.

Key Terms

Audit programme: A coordinated set of audits planned for a defined period and directed toward specified purposes.

Audit plan: The detailed arrangements for conducting an individual audit.

Audit universe: The complete set of processes, sites, products, systems, suppliers, obligations, or themes that may be audited.

Risk-based auditing: Directing audit attention according to the significance of risks and the strength of available controls.

Audit objective: The purpose or intended result of a particular audit.

Audit scope: The boundaries and coverage of an audit.

Audit criteria: Requirements or standards used to evaluate audit evidence.

Audit evidence: Verifiable records, statements of fact, observations, data, or other information relevant to the criteria.

Assurance map: A structured view of risks, controls, assurance providers, coverage, and gaps.

Audit intensity: The depth, frequency, duration, technical complexity, and resource level applied to an audit.

Independence: Freedom from conditions that threaten impartiality or objective judgement.

Objectivity: The ability to evaluate evidence fairly without bias or conflicts of interest.

Residual risk: Risk remaining after controls and responses have been applied.

Escalation: The formal communication of significant issues to a higher level of authority.

Corrective action: Action taken to eliminate the cause of a detected nonconformity and prevent recurrence.

Effectiveness: The extent to which planned activities are realised and intended results achieved.

Audit risk: The possibility that an audit conclusion is inappropriate because significant issues are not detected or properly evaluated.

Continuous monitoring: Ongoing or frequent review of data and controls to identify deviations or emerging risks.

Professional scepticism: An enquiring and critical attitude toward evidence and explanations.

Review Questions

Short Answer Questions

1. Distinguish an audit programme from an individual audit plan.

2. Identify four criteria that may be used to prioritise audit subjects.

3. What is the difference between audit scope and audit criteria?

4. Why is auditor independence important in a quality audit programme?

5. What is the purpose of an assurance map?

Long Answer Questions

1. Explain how organisational risk should influence audit frequency, scope, resources, and follow-up.

2. Discuss the governance responsibilities of the programme owner, process managers, auditors, and executive management.

3. Describe a controlled workflow for translating an approved audit programme into an individual audit.

4. Evaluate the role of competence, independence, ethics, and professional scepticism in risk-based auditing.

5. Explain how digital audit-management systems, analytics, remote auditing, and AI can support—but not replace—professional audit judgement.

Analytical / Application Questions

1. A company audits every department annually, but customer complaints and supplier changes have increased in one product line. Design a revised risk-based audit response, including objectives, scope, criteria, resources, frequency, and escalation.

2. An assurance map shows that three functions review document control while no function evaluates outsourced cybersecurity controls. Analyse the governance problem and recommend an appropriate programme response.

3. During an audit, management disputes a major finding and asks the auditor to remove it before executive reporting. Explain how the auditor and programme owner should respond while preserving fairness, independence, evidence integrity, and timely escalation.

22. Multiple Choice Questions with Answers

Question 1

What is the primary strategic purpose of a risk-based audit programme?

A. To ensure every department is audited for exactly the same duration

B. To direct assurance toward risks most capable of affecting organisational objectives

C. To replace management responsibility for operational controls

D. To maximise the number of findings reported each year

Correct Answer: B. To direct assurance toward risks most capable of affecting organisational objectives

Question 2

Which item is an audit criterion?

A. The auditor’s personal preference for a procedure

B. The date selected for fieldwork

C. An applicable regulation, specification, or approved internal requirement

D. The number of auditors assigned to the audit

Correct Answer: C. An applicable regulation, specification, or approved internal requirement

Question 3

A process has recurring complaints, major technology changes, and weak corrective-action results. What is the most appropriate programme response?

A. Reduce its audit frequency because it has already been audited

B. Wait until the next fixed annual cycle

C. Increase audit attention and consider a focused or event-driven audit

D. Remove it from the audit universe until performance improves

Correct Answer: C. Increase audit attention and consider a focused or event-driven audit

Question 4

Which statement best distinguishes an audit programme from an audit plan?

A. A programme covers coordinated audits and priorities; a plan covers one audit’s arrangements

B. A programme contains only findings; a plan contains only criteria

C. A programme is prepared by auditees; a plan is prepared by customers

D. There is no meaningful distinction between them

Correct Answer: A. A programme covers coordinated audits and priorities; a plan covers one audit’s arrangements

Question 5

What is the main purpose of an assurance map?

A. To calculate employee salaries

B. To identify assurance coverage, duplication, and gaps across risks and providers

C. To replace all external audits

D. To rank auditors according to the number of findings they issue

Correct Answer: B. To identify assurance coverage, duplication, and gaps across risks and providers

Question 6

Which situation most clearly threatens auditor independence?

A. An auditor reviews objective records against approved criteria

B. An auditor uses a technical specialist for a complex process

C. An auditor evaluates a control for which they recently had direct operational responsibility

D. An auditor reports significant issues to executive management

Correct Answer: C. An auditor evaluates a control for which they recently had direct operational responsibility

Question 7

During the Meditron case, why was a cross-functional audit more appropriate than separate departmental audits?

A. Contamination risk arose from interactions among suppliers, equipment, competence, and production controls

B. Departmental audits are never valid in a quality system

C. Cross-functional audits require no criteria or evidence

D. The organisation wanted to avoid interviewing operators

Correct Answer: A. Contamination risk arose from interactions among suppliers, equipment, competence, and production controls

Question 8

Which statement about audit risk is correct?

A. It is identical to organisational risk

B. It concerns the possibility that an audit conclusion is inappropriate or significant issues are missed

C. It means that every audit must produce a nonconformity

D. It is eliminated when an organisation is certified

Correct Answer: B. It concerns the possibility that an audit conclusion is inappropriate or significant issues are missed

Question 9

What is the most appropriate use of AI in an audit programme?

A. Allowing AI to issue final conclusions without human review

B. Using AI to support trend detection while validating outputs through professional judgement

C. Replacing evidence collection with generated text

D. Uploading confidential records to any public AI service

Correct Answer: B. Using AI to support trend detection while validating outputs through professional judgement

Question 10

A serious legal breach is identified during fieldwork, but the auditee disputes the wording. What should happen?

A. Delay all communication until the next annual report

B. Suppress the issue if consensus on wording is not reached

C. Promptly escalate the potential breach while allowing factual clarification and fair review

D. Close the audit immediately without recording the issue

Correct Answer: C. Promptly escalate the potential breach while allowing factual clarification and fair review