EXECUTING A PROGRAM RISK AUDIT