The audit's scope and testing protocols were determined based on an analysis of risk.
In addition, the authors pay close attention to the analysis of risk and how it may be managed.