Which of the following statements is correct regarding risk analysis?

Risk analysis in internal audit planning is not based only on one factor, such as maximum possible loss or likelihood of occurrence. A proper comparative risk analysis considers multiple qualitative and quantitative risk factors, including judgment required by management, complexity of transactions, prior control issues, regulatory exposure, materiality, change, and susceptibility to fraud or error. Areas requiring significant management judgment usually carry higher inherent risk because estimates, assumptions, and subjective decisions may affect reporting, operations, and compliance. Option B is too narrow because the largest possible loss does not always represent the highest overall risk. Option C is also incomplete because likelihood alone ignores impact. Option D is incorrect because meaningful risk comparison can include qualitative assessment, not only numeric scoring. Therefore, Option A is the correct answer.