How should I approach this audit execution problem without missing the real risk?

I am worried about missing the root issue because the workpaper steps feel too mechanical. The source discussion was triggered by 'Risk-Based Testing – How Do You Prioritize?'. The practical concern underneath it was: I’ve been thinking a lot about risk-based testing lately and I’m curious how everyone approaches it in practice. * How do you decide which areas to focus on first? * Any tips for balancing high-risk items with routine checks? * Do you have any favorite frameworks, tools, or metho