Essentials 2: Managing risk: audit and beyond