I hope that there is an actual auditor on here somewhere that can explain this concept a little better. It seems like an impossible task, planning for the unknown.
The article mentions that this is a very subjective process. It seems like a lot of it comes down to character judgements. Do the people in charge seem honest and capable? Auditors would need to be judges of character as well as figures. Maybe they even have some psychological training. I'm sure this is a difficult process.
Does anyone on here have any experience measuring inherent risk? How much of a science is this? What are the consequences of mistakes?