Internal Audit process Risk Assessment is the first logical step of the Internal Audit process since it identifies the areas of greater relevance which must be further examined (included in the three-year “rolling” audit plan), consistently with the size of the Internal Audit Division.