The best course of action is to conduct a risk assessment and design the audit plan to cover the areas of highest risk. ISACA IT Audit and Assurance Standard S11 (Use of Risk Assessment in Audit Planning), Substandard S03, states that “The IS auditor should use an appropriate risk assessment technique or approach in developing the overall IS audit plan and in determining priorities for the effective allocation of IS audit resources.” The IS auditor should not rely on the prior-year audit plan since it may not have been designed to reflect a risk-based approach (the newest systems are not necessarily the systems with the highest risk). Auditing the new ERP application does not reflect a risk-based approach and thus is not the correct answer. Although ERP systems typically contain sensitive data and may present risk of data loss or disclosure to the organization, without a risk assessment, the decision to audit the ERP system is not a risk-based decision. Auditing the e-commerce server because it was not audited last year does not reflect a risk-based approach and thus is not the correct answer. In addition, the IT manager may know about problems with the e-commerce server and may be intentionally trying to steer the audit away from that vulnerable area. Although at first glance e-commerce may seem to be the most risky area, an assessment must be conducted rather than relying on the judgment of the IS auditor or IT manager. Auditing both the e-commerce server and the ERP application does not reflect a risk-based approach and thus this is not the correct answer.