audit planning and risk assessment case study