When determining risk, auditors consider factors such as the severity, the likelihood of recurrence, and the extent and potential impact of an issue. Two findings may appear similar on paper but present very different levels of risk depending on the circumstances.