What is the recommended approach when risk is dynamic?

• A. A risk-based, flexible approach is preferred.
• B. A fixed annual calendar is sufficient.
• C. Audits should ignore risk.
• D. Only financial risk matters.

Answer: (A)

Dynamic risk requires a risk-based, flexible approach that can adapt as threats evolve, new assets appear, and controls change. In cybersecurity and IT, risk isn’t static—the landscape shifts with threat intel, discovered vulnerabilities, and changing business priorities. A risk-based, flexible approach lets auditors re-prioritize, update the risk assessment, and adjust scope, timing, and resources to focus on areas with the greatest potential impact. This keeps assurance relevant and timely, ensuring effort goes where it matters most rather than sticking to a rigid schedule that might miss emerging risks. Fixed calendars can’t respond quickly to changing risk, and ignoring risk or focusing solely on financial risk misses important cybersecurity and operational exposures that could affect the organization.