"Risk-based auditing is a style of auditing which focuses upon the analysis and management of risk. In the UK, the 1999 Turnbull Report on corporate governance required directors to provide a statement to shareholders of the significant risks to the business."

"Risk-based auditing ensures that the internal audit activity is focusing its efforts on providing assurance and advisory services related to the organization’s top risks. Through risk-based auditing, the internal audit activity helps executive management and the board understand whether the organization’s risk management processes are sufficient and how to better achieve organizational objectives through good governance, risk management, and control. This requires internal auditors to have a working knowledge of basic concepts, frameworks, tools, and techniques related to risk and risk management."