In performing a risk-based IT audit, when developing audit recommendations, the IT auditor should: Question 22 options: Analyze the inherent risk and cost of additional controls in relation to the potential for loss. Use Computer Assisted Audit Techniques (CAATs) to test transactions. Determine if the risk is material based solely on auditor judgment. Perform substantive procedures to eliminate control risk