A risk audit differs from a risk review in that a risk audit:
-
A
Focuses on identifying new risks while a review closes resolved ones
-
B
Examines the effectiveness of risk responses and the risk management process itself
-
C
Is performed by external parties only while reviews are internal
-
D
Updates the probability scores; reviews update the impact scores