We don't need to assess risk.
This requires determining which laws, regulations, and other compliance requirements are significant to the audit objectives and assessing the risk that significant noncompliance could occur.