As baseline knowledge of the effectiveness of internal controls develops, the periodic risk assessment may consider the reliability and effectiveness of these controls in mitigating the significance and/or likelihood of a risk occurrence. Based on this knowledge, various risks may be reclassified due to improved knowledge of the system of internal control. However, even in areas where controls are thought to be effective, internal audit must incorporate the periodic testing of key controls to ensure they continue to help mitigate critical risks
