A company proposes conducting one small audit and then ending its audit program. Explain why this approach conflicts with the course’s description of an ongoing audit program, and name factors that can affect audit duration.

### The concept The course describes an audit program as an ongoing series of smaller audits, rather than one review that permanently establishes compliance. Regulations and external standards can change, and organizational systems and risks can also change, so repeated review helps the organization check whether its controls and practices remain appropriate. This does not mean every audit has the same scope or duration. The supplied material says an audit may take weeks to months, depending on organizational size, current risks and cybersecurity infrastructure, the software or dashboard used, and the type of audit. ### What a good answer covers - Explain that an audit program consists of recurring, smaller audits. - Connect recurrence to changing regulations and external standards. - State that one audit cannot establish ongoing compliance indefinitely. - Name the factors listed in the material that affect duration. ### Terms - **Audit program**: An organized, continuing set of audit activities. - **External standard**: A standard developed outside the organization that may set expectations relevant to its controls. ### Remember An audit is a review at a particular time; an audit program keeps review going as requirements and conditions change.