These four C's – culture, competitiveness, compliance and cyber – offer suggestions to directors regarding what they should expect of a risk-based audit plan.