Why Auditors Struggle With Risk Assessment