 In assessing risk, auditors are encouraged to use an approach that allows different programs to be identified as high risk over time.The auditor is not expected to perform risk assessments on smaller Type B programs with expenditures that do not exceed 25% of the Type A threshold determined in step 1.Type B programs which have a low risk of not complying are not required to be audited.