Using risk assessments to determine areas to be included in an audit plan is a primary benefit because it helps to prioritize the audit activities based on the level of risk and the potential impact of the audit findings. This way, the audit resources, such as time, staff, and budget, can be allocated more efficiently and effectively to the areas that need the most attention and provide the most value.
References
ISACA CISA Review Manual, 27th Edition, page 256
What is the Purpose of a Risk Assessment?
Mastering the Process of Risk Assessment

The authority given to the audit function is one of the components that is found in an audit charter. According to the IIA, the audit charter is a formal document that defines internal audit's purpose, authority, responsibility and position within the organization1. The authority given to the audit function includes the scope of its activities, the access to records, personnel and physical properties relevant to its work, and the independence and objectivity of its staff2. The authority given to the audit function helps to ensure that internal auditors can perform their duties effectively and efficiently, and that they can provide assurance and consulting services that add value and improve the organization's operations3.
The other options are not found in an audit charter. The process of developing the annual audit plan is not part of the audit charter, but rather a separate document that outlines the methodology, criteria and resources for selecting and prioritizing audit engagements based on a risk assessment4. Required training for audit staff is not part of the audit charter, but rather a component of the quality assurance and improvement program that evaluates the competence and performance of internal auditors and provides them with opportunities for professional development5. Audit objectives and scope are not part of the audit charter, but rather specific elements of each individual audit engagement that define the expected outcomes and the boundaries of the audit work.

The necessary condition for effective risk management in IT governance is that risk evaluation is embedded in management processes. Risk evaluation is the process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable. Risk evaluation should be integrated into the management processes of planning, implementing, monitoring, and reviewing the IT activities and resources. This will ensure that risk management is aligned with the business objectives, strategies, and values, and that risk responses are timely, appropriate, and effective. References:
* CISA Review Manual (Digital Version)
* CISA Questions, Answers & Explanations Database

The auditor's best action when IT management provides suitable evidence for a control that had been concluded as ineffective is to re-perform the audit before changing the conclusion. This means that the auditor should verify the validity, completeness, and timeliness of the evidence provided by IT management and test the effectiveness of the new control in meeting the audit objectives. The auditor should not change the conclusion based on evidence provided by IT management without re-performing the audit, as this could compromise the auditor's independence and objectivity. The auditor should also not explain to IT management that the new control will be evaluated during follow-up or add comments about the action taken by IT management in the report, as these actions do not address the original audit finding. References: CISA Review Manual, 27th Edition, page 439