Audit resources available to the internal audit function play a critical role in deciding the scope of an audit engagement.

Consider a situation in which the internal audit function is only able to allocate resources to just one of the following processes. As a CAE of this internal audit function, which one of the following would you choose to audit:

• audit a high-risk process that was audited last year
• audit a moderately risky process that was last audited four years ago

Choose only one and justify your choice.