The best source of potential audit engagement topics when establishing the internal audit activity's annual plan is the risk factors utilized in the organization's risk models. Risk models help identify areas with the highest potential risk, which should be prioritized to ensure the organization's objectives are met and resources are used effectively. While recent changes in management objectives can also be important, they are just one aspect of the broader risk factors that an effective audit plan should consider.