Despite the focus, however, most audit plans don’t currently prioritize the risks, according to a new report from the Institute of Internal Auditors.