Exam IIA-CIA-Part2 topic 4 question 66 discussion

I understand that existing risks and controls are identified during the planning phase. The other considerations (1 and 4) must be taken into account during the realization phase.

I think B is incorrect and should be A. When IA plan an audit of any topic, firstly objectives are assessed, then risk and later on controls. An accounting system/application is in use for 5 years but objectives must be set for each engagement either with the client (if consulting) or by audit when assurance because in either of them they talk with the client to have the scope of the given audit engagement. Below are incorrect answers because: Presence or absence of computerized and manual controls that address risks. - this is assessed during Fieldwork when IA assess controls mitigating all addressed risks. Testing of the system/application for bugs and errors. - this is also during Fieldwork right after creation of TSM which is approved at the end of Control Assessment phase.