Audit Risk Universe Confusion?

So this is the blog post, found via a Tweet from @theiia , that compelled me to set up 'Blogging Auditor'. Kiko Harvey examines gaps between the risk universe and the audit universe in a new IAOnline blog post. I was rather confused by the whole Audit Risk Universe business especially when mentioned in connection with the 'rest of the risk universe'. I can understand the need to create an Audit Risk Universe if the organisation does not have a risk management system in place. However, once the organisation has begun to embed risk management then surely the need for an Audit Risk Universe will begin to reduce. Once the risk management within the organisation reaches a good maturity then the need for an Audit Risk Universe will be obsolete? Obviously some work will need to be done on a yearly basis on the organisation's management of the risk management process so that Audit can gain some assurance on the reliance they can place on the output of the risk management process. Audit planning should then involve discussions with management around the risks identified by management, the risks known to Audit during the course of their work and some crystal ball gazing as to what risks might be on the horizon. I do not understand why you would have an Audit Risk Universe if you have an organisation risk universe? Yours confused Blogging Auditor