What is the primary purpose of a risk audit in the program?

• A. To review and test everything identified in the assessment scope and test the effectiveness of controls
• B. To design new business models
• C. To replace risk assessment activities
• D. To train vendor staff

Answer: (A)

The main idea behind a risk audit is to verify that the controls put in place to address identified risks are actually present, functioning, and covering the areas outlined in the assessment scope. By reviewing and testing everything within that scope, the audit gathers evidence about control effectiveness and helps confirm that residual risk is being managed as intended. It also spots gaps, weaknesses, or drift so they can be remediated, ensuring the program’s risk posture is verifiable and up to date.

This focus distinguishes a risk audit from other activities. Designing new business models is a strategic change effort, not an audit of controls. Replacing risk assessment activities would skip the essential validation step that shows whether the assessment’s identified controls are truly effective. Training vendor staff serves a different purpose centered on capability-building rather than validating control effectiveness.