Audits are not focused on risk and significance

Control

Identify key risk drivers for plan development