A state audit in the context of a risk-based approach