The management team of PVSS is concerned that the team may be trying to audit too many areas and that things may be missed. They are also concerned that PVSS will not be able to finish solving all of the issues in a timely manner. With this in mind, they have decided to focus on only a few key issues.

• What is your understanding of how a risk-based audit may address these concerns?
• Explain how you would describe to the management team the difference between a compliance and a substantive audit. Provide examples to help clarify your explanation.
• Which type of audit should be performed in this project and why?