We need to assess the risk of people not doing their jobs.
This requires determining which laws, regulations, and other compliance requirements are significant to the audit objectives and assessing the risk that significant noncompliance could occur.