Risk factors aren't reliable at telling auditors when a response is needed.
In addition, if during the performance of the attestation engagement, risk factors or other conditions are identified that cause the auditors to believe that an additional response is required, such factors or other conditions, and any future response the auditors concluded was appropriate, should be documented.