More and more organizations are moving to a risk-based audit approach which is used to assess risk and helps an IT auditor make the decision as to whether to perform compliance testing or substantive testing.In a risk-based approach, IT auditors are relying on internal and operational controls as well as the knowledge of the company or the business.