An auditor has one month to review five applications. One recently began processing sensitive data through an untested interface. What should primarily drive audit scheduling?

1. The applications' alphabetical order
2. Equal time for every application regardless of risk
3. The applications' assessed risks and significance to business objectives
4. The preference of the team with the most available staff