Which statement best differentiates a risk assessment from a risk audit?

• A. Risk assessment provides a high-level view and identifies gaps; risk audit reviews and tests the effectiveness of controls
• B. They are identical activities
• C. A risk audit replaces risk assessment every year
• D. Risk assessment only considers financial risk

Answer: (A)

Differentiating risk assessment from a risk audit hinges on understanding their different roles in risk management. A risk assessment takes a forward-looking view of the organization’s risks to its objectives, high-level in scope, and identifies gaps in controls or in the overall risk treatment plan. It helps prioritize where actions are needed and guides how to strengthen defenses before problems occur. A risk audit, by contrast, is a verification activity that examines how well the controls actually work in practice. It tests control design and operating effectiveness, using evidence to confirm that risks are being mitigated as intended.

That combination—a proactive, gap-identifying assessment plus an evidence-based check of control effectiveness—best differentiates the two.

The other statements don’t fit because: they imply the activities are identical, or that an audit replaces the assessment annually, or that risk assessment only covers financial risk, whereas in reality risk assessment covers many risk types (operational, strategic, compliance, etc.) and audits serve to validate control performance rather than replace ongoing assessments.