During the process of setting the annual audit plan, the chief audit executive receives a...

The internal audit plan must be risk-based, as required by the IIA Standards. If cybersecurity has been identified as a high risk during the annual risk assessment, then it should be included in the audit plan to provide assurance over the adequacy of controls.

Including engagements simply to satisfy management (Option A) or for auditor learning purposes (Option B) does not align with risk-based planning principles. Likewise, management requests alone (Option D) do not dictate audit plan content; engagements must be prioritized based on risk to the organization.