When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment to
ensure that:

A.
controls needed to mitigate risks are in place.

B.
vulnerabilities and threats are identified.

C.
audit risks are considered.

D.
a gap analysis is appropriate.

Explanation:
In developing a risk-based audit strategy, it is critical that the risks and vulnerabilities be understood.
This will determine the areas to be audited and the extent of coverage. Understanding whether
appropriate controls required to mitigate risksare in place is a resultant effect of an audit. Audit risks
are inherent aspects of auditing, are directly related to the audit process and are not relevant to the
risk analysis of the environment to be audited. A gap analysis would normally be doneto compare
the actual state to an expected or desirable state.