Identify at least three risks that auditors need to consider