Certified Information Systems Auditor (CISA) — Question 1376

Which of the following MUST be completed as part of the annual audit planning process?

Answer options

• A. Fieldwork
• B. Risk control matrix
• C. Risk assessment
• D. Business impact analysis (BIA)

Correct answer: C

Explanation

The risk assessment is crucial in the annual audit planning process as it helps identify and evaluate potential risks that may affect the audit's effectiveness. While fieldwork, risk control matrix, and business impact analysis are important components, they do not necessarily need to be completed as part of the initial planning phase.