This standard provides guidance for conducting resilience, security, crisis, continuity and other risk-based audits within the context of management systems and includes practical advice on conducting audits. It will provide guidance on the management of audit programs, conduct of internal or external audits of risk, and resilience based management systems such as security, crisis, continuity, and emergency management, including the competence and evaluation of auditors.