The frequency and approach to assessing residual risk are primarily influenced by the expectations set by the board and senior management. These expectations shape the internal audit function's priorities, including how often residual risk should be assessed and the methods used to evaluate it. This ensures that the internal audit activities are aligned with the strategic objectives and risk appetite of the organization, as defined by its senior leadership.
Reference:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard 2120 - Risk Management