A risk assessment must be completed as part of annual audit planning. ISACA's ITAF-based guidance states that the IS audit and assurance function shall use an appropriate risk assessment approach and supporting methodology to develop the overall IS audit plan and determine priorities for effective allocation of audit resources.
Option C is correct because audit planning is fundamentally risk-based under ISACA guidance. Annual planning requires identifying and prioritizing risk areas so the audit plan focuses on the areas of greatest significance. ISACA also notes that, before creating the annual audit plan, the organizationwide risk register should be reviewed thoroughly to prioritize risk areas.
Option A may inform audit planning in some organizations, but it is not a universal required planning step.
Option B can be useful, but it is optional and supplementary, not mandatory.
Option D is typically developed at the engagement level for specific audits rather than as a mandatory organizationwide annual planning deliverable.
Therefore, C is the best answer because risk assessment is the required foundation of the annual audit plan under ISACA guidance.
References (Official ISACA):
* ISACA Journal, Developing the IT Audit Plan Using COBIT 2019 - ITAF requires an appropriate risk assessment approach to develop the overall IS audit plan.
* ISACA Journal, Auditing and Digital Transformation Are at a Crossroads - before creating the annual audit plan, the organizationwide risk register should be reviewed thoroughly.
* ISACA, Certification Exam Candidate Guide - includes evaluation of audit processes and quality programs, supporting structured audit planning.

Here ' s the breakdown, considering
the need for DLP visibility in the cloud:
Verified Answer
C). Employ a cloud access security broker (CASB).
Very Short Explanation
CASBs are specifically designed to enhance visibility and control over cloud-based data. They can monitor data flows, enforce security policies, and often have DLP capabilities built-in, making them the ideal solution in this scenario.
References
ISACA Resources (Glossary): Definitions of Cloud Access Security Broker (CASB) highlight their role in cloud security and governance.
Industry Research (Gartner, etc.): Research on CASB tools emphasizes their ability to address visibility and control challenges for cloud data.

The central goal of DLP is to prevent sensitive data-such as PII, PHI, or intellectual property-from leaving the organization through unauthorized channels. DLP solutions monitor, detect, and block potential data exfiltration via email, endpoints, cloud applications, or removable media. While compliance (D) is often a driver, it is a secondary outcome of implementing DLP. Enhancing performance (A) and recovery automation (B) are not objectives of DLP. ISACA positions DLP as a critical control for confidentiality under DSS05 (Managed Security Services).
References (ISACA): COBIT 2019, DSS05 Managed Security Services.