When setting the scope for the identification and assessment of key risks and controls in a process, which of the following would be the least appropriate approach?
When setting the scope for the identification and assessment of key risks and controls in a process, which of the following would be the least appropriate approach?
Developing the scope of the audit based on a bottom-up perspective to ensure that all business objectives are considered would be the least appropriate approach. This method might result in an audit that is too broad and not focused on key risks and controls. Instead, an audit scope should be tailored to address specific, critical business objectives and associated risks to provide value. The other options provide more targeted and practical approaches for setting the scope of the audit.
why not d
D is a typical process of identifying key controls. A is for deciding the audit scope and objectives, which should be done before starting the individual audit, in whch auditors identify key risks and controls.