In risk assessment, which statement describes how evidence sufficiency should respond to higher risk areas?

• A. Higher risk areas require less evidence because risk is already considered in planning.
• B. Higher risk areas require the same amount of evidence regardless of risk.
• C. Higher risk areas require more audit evidence or higher sampling to achieve appropriate assurance.
• D. Higher risk areas should be deprioritized in evidence gathering.

Answer: (C)

When risk is higher in a particular area, the amount and quality of evidence needed must increase to provide a credible level of assurance. Higher risk means there’s a greater chance of misstatements, so the auditor reduces detection risk by gathering more audit evidence or by choosing more intensive sampling and procedures. This approach ensures that the overall level of assurance remains appropriate despite the greater risk. Choices that suggest less evidence, the same amount of evidence regardless of risk, or deprioritizing high‑risk areas don’t align with how risk-based auditing works, because they would undermine the reliability and sufficiency of the audit conclusions.