Let’s see: are you sure that your risk-based approach is effective? If you haven’t updated it during the year…if only the Internal Audit talks about risks…or if the budget is not related to it…well, it’s clear: the risk-based approach is not effective.