New standard provides risk-based approach to group audits