Which term is determined during annual risk assessment planning?

• A. Audit Reports
• B. Access Approvals
• C. Provisioning Process
• D. Audit Frequency

Answer: (D)

Planning the cadence of assurance activities is the key idea here. In annual risk assessment planning, you evaluate risks across systems and controls and decide how often you need independent checks and reviews. This determines the audit frequency—the schedule for when audits or control assessments will occur. Aligning audit frequency with risk ensures high-risk areas are reviewed more often while conserving resources on lower-risk areas, keeping oversight timely and effective. Audit reports are the results of audits, the provisioning process handles granting or revoking access, and the provisioning process is not about setting audit timing. So the term determined during annual risk assessment planning is how often audits should occur.