Describe in detail the process of preparing for a risk audit. What standard or regulatory framework do you think should be used as the basis of review? What documents should be created/made available - BIA, Risk Register, Risk Appetite Statement, etc.? What role should management play in preparing for the audit? What are the potential downfalls of holding such an audit? Given all the preparations required, is contracting for an independent risk audit worth the expense?