From this risk assessment, in combination with department input and past audit experience, the annual corporate audit plan is created and approved by the Audit and Oversight Committee of the board of directors.