Audit under the umbrella of risk