Risk Assessment is the first logical step of the Internal Audit process since it identifies the areas of greater relevance which must be further examined (included in the three-year “rolling” audit plan), consistently with the size of the Internal Audit Division.