http://www.aicpa.org/download/infotech/2008_Top_Tech/1558-395_Risk_Based_Auditing_FAQ-FINAL.pdf