2. **How does an organization determine the scope and frequency of internal audits, and what methodologies are commonly used to assess risk and prioritize audit activities?

2. **How does an organization determine the scope and frequency of internal audits, and what methodologies are commonly used to assess risk and prioritize audit activities?