Which of the following statements is true regarding an organization's chief audit executive (CAE) when prioritizing the audit universe?

The risk-factor approach is a comprehensive method used by the chief audit executive (CAE) to prioritize the audit universe. This approach goes beyond simply considering likelihood and impact. It incorporates multiple factors such as the complexity of operations, quality of internal controls, potential for fraud, time since last audit, and management's perception of risk. By evaluating various weighted risk factors for each auditable entity, the CAE can create a more nuanced and robust prioritization that aligns with the organization's strategic objectives and risk appetite.

B. Risk likelihood is only one component of a comprehensive risk assessment; using it alone is insufficient for effective prioritization.
C. Risk impact is only one component of a comprehensive risk assessment; using it alone is insufficient for effective prioritization.
D. A heat map is a visual tool used to represent risk assessment results (typically likelihood and impact), not the underlying method for conducting the assessment and prioritization itself.

1. The Institute of Internal Auditors (IIA). (2020). Practice Guide: Developing the Internal Audit Plan. Page 11. "The CAE may use a variety of risk factors to prioritize the audit universe... Examples of risk factors include impact, likelihood, management’s perception of risk, quality of internal controls, complexity, and time since the last audit."

2. Moeller, R. R. (2021). Brink's Modern Internal Auditing (9th ed.). Wiley. Chapter 10, "Developing the Annual Audit Plan," discusses using a risk factor-based approach, often with a scoring model, to rank and prioritize potential audit projects.