It rather depends what you mean by risk-based audit, eg audit for what ?.
Many food production audit schemes are safety prioritised for which there are a number of referenced examples in various threads on this forum based initially on a range of parameters like type of product, size of factory, output capacity and subsequently on results, eg point scoring schemes or by scoring defects as critical, major etc and applying (again empirical) combination decision tables to get an overall score. Similar idea I think as used nationally for assessing restaurants in UK. Scores on Doors ? The method of point scoring is usually empirical IMO which is one argument in favour of defect approach.
Theoretical optimum sampling frequencies for general audits hv also been proposed, eg here is 1st page from one such –
JSTOR_ Management Science, ...pdf 104.29KB
(already posted in a thread here somewhere)
Rgds / Charles.C