GAO should develop and document procedures to ensure the appropriate risk-based assessments are completed when planning to implement an alternative to it’s full annual inventory to ensure samples are targeted to the highest risk information technology assets, such as those that may process or store sensitive or classified information.