Risk-based auditing ensures that the internal audit activity is focusing its efforts on providing assurance and advisory services related to the organization's top risks.

Through risk-based auditing, the internal audit activity helps executive management and the board understand whether the organization’s risk management processes are sufficient and how to better achieve organizational objectives through good governance, risk management, and control.

This requires internal auditors to have a working knowledge of basic concepts, frameworks, tools, and techniques related to risk and risk management.