Risk-Based Internal Audit aligns audit planning with the organization's risk profile, focusing effort on high-risk areas while reducing testing in low-risk domains. Annual audit plans consider inherent risk, control maturity, time since last audit, management concerns, and regulatory focus. This approach maximizes audit value by concentrating expertise where risks are greatest and emerging. A multinational corporation's internal audit function uses a risk-based methodology to allocate 60% of annual hours to cyber security, financial reporting, and regulatory compliance, 30% to operational effectiveness in high-risk regions, and 10% to routine low-risk processes.