A successful risk-based IT audit program should be based on:

A successful risk-based IT audit program should be based on:

A.
an effective scoring system.

B.
an effective PERT diagram.

C.
an effective departmental brainstorm session.

D.
an effective organization-wide brainstorm session.

E.
an effective yearly budget.

F.
None of the choices.

Explanation:

A successful risk-based IT audit program could be based on an effective scoring system. In
establishing a scoring system, management should consider all relevant risk factors and avoid

subjectivity. Auditors should develop written guidelines on the use of risk assessment tools and
risk factors and review these guidelines with the audit committee.