A riskdriven approach to the internal audit

Internal auditors should consider the risks pertinent to an auditee when planning the work. Internal auditors may select a proceduresdriven approach or a riskdriven approach. In a proceduresdriven approach, the audit procedures are chosen without full consideration of the risks present. Rather, the internal auditor may use procedures because they are commonly employed or because they were used on the last examination of the auditee. In a riskdriven approach, specific procedures are planned only after consideration of the risks. A riskdriven approach is generally more effective and efficient than a proceduresdriven approach because the internal auditors efforts are focused on areas with relatively more risk.