What drives the audit plan?

• A. Risk and organizational objectives.
• B. Auditor's personal preference.
• C. Regulatory calendar alone.
• D. Checklists and compliance items only.

Answer: (A)

Audit plans are driven by risk and organizational objectives. A risk-based approach ensures the plan targets areas where gaps or control weaknesses could most affect the entity’s goals, including cybersecurity risks, data protection, and governance processes. The plan is formed from formal risk assessments, changes in the threat landscape, and resource considerations, so it aligns with the organization’s risk appetite and strategic priorities. Timing can be influenced by regulatory calendars, but these calendars alone do not determine what gets audited. Personal preference or relying solely on checklists does not establish the audit plan; those factors come into play only after risks and objectives guide priorities. In essence, the audit plan is shaped by risk and objectives to ensure critical areas receive appropriate assurance.