And to take this a step further, I complete a seperate risk assessment for each area that I do audit. And compile this list on my audit schedule, to make sure that my schedule is in line with the assigned risk.
This process took a year to complete, doing a risk assessment each time I completed an audit, and I review with each new audit that I complete. It is a living document, and used in both planning and scheduling.