Why is cyclical auditing outdated?

• A. Risks are dynamic and evolve continuously.
• B. Risks are static and defined.
• C. Risks are irrelevant to audits.
• D. The audit plan should be determined by external auditors.

Answer: (A)

Dynamic risk thinking is the key idea. In cybersecurity, threats and control environments change constantly—new vulnerabilities emerge, configurations drift, and attacker techniques evolve. A fixed, cyclical audit schedule can miss those shifts that occur between audits, leaving gaps unaddressed. By contrast, continuous auditing and risk-based approaches use ongoing data, automation, and analytics to monitor controls in real time and adjust focus as risks evolve, which is why cyclical auditing is considered outdated. The other statements don’t fit because risks are not static, risks are not irrelevant to audits, and audit plans shouldn’t be determined solely by external parties; effective auditing now hinges on continuously updated risk information.