In planning tests of compliance with significant laws, regulations, and other compliance requirements, auditors should assess the risk that noncompliance could occur.
Auditors calculate risk using a risk matrix of likelihood and damage.