All organizations face risks, but not all risks are equal. Some risks are more serious than others and can have a greater impact on the organization. Internal audit functions must be able to identify and assess the risks facing their organizations so they can plan their audits accordingly.