When auditors use ‘The Risk-Based Audit Approach’, there are four-step to approach control evaluation. 

They are as follows : 

1) Determine the threats facing the accounting information systems (AIS). 

2) Identify the control procedures that should be in place to minimize each threat. 

3) Evaluate the control procedures. 

4) Evaluate weakness (errors and irregularities not covered by control procedures). 

Required: 

Apply your understanding in ‘The Risk-Based Audit Approach’ to explain the significance of the first step. (5 marks)