Drawing up an internal audit plan looks simple: identify the most important risks, select audits and allocate the available capacity. In reality, audit planning is one of the more complex parts of the profession.
Standard 9.4 of the Global Internal Audit Standards requires the plan to be based on a documented assessment of the organisation’s strategies, objectives and risks, supplemented by input from the board and senior management and the professional judgement of the chief audit executive (CAE).
There are some important nuances here.
Do not start with the risk register
A common pitfall is for Internal Audit to use the enterprise risk register as its audit universe and then translate the highest risks into audits. That is too simple.
The starting point is the organisation’s strategy and objectives. The relevant question is not only where the biggest risks lie, but above all: what is the organisation trying to achieve, and where could that go wrong?
Strategic changes, major investments, new technology or changes to the business model may hardly be visible in the formal risk register yet, while that is precisely where important assurance questions lie.
That is why the company’s strategy and the risk register are important input for internal audit’s own assessment as the basis for the audit plan.
Stakeholders provide input, but do not determine the plan
Conversations with the board, the audit committee and senior management are essential. They see developments that are not always apparent from formal documentation.
But there is an important difference between gathering input and letting stakeholders set the audit agenda. A plan that only reflects management’s wishes can miss important risks. A purely technical, risk-driven plan, on the other hand, may not sufficiently match what the board and the audit committee need.
The quality lies in combining both perspectives.
Look at coverage, not just at audits
A strong audit plan makes clear not only which audits will be carried out, but also which significant risks they cover.
Not every high risk needs to be examined by Internal Audit every year. Recent assurance may be available, another assurance provider may be better positioned, or a topic may be deliberately postponed.
But that choice must be explainable.
Standard 9.4 also requires the CAE to communicate when high-risk areas are not included in the plan, and what the consequences are when limited capacity restricts audit coverage.
This also makes clear that capacity must not quietly determine the risk picture. The first question is which assurance is needed; only then which people, competencies and resources it requires.
Consider total assurance coverage
Internal Audit does not operate alone. Risk Management, Compliance, Security, Privacy, the external auditors and other assurance providers may cover parts of the risk landscape.
Mature audit planning therefore looks not only at Internal Audit coverage, but at the organisation’s broader assurance coverage. This helps to avoid overlap and to make gaps visible.
An annual plan is not a static plan
Standard 9.4 explicitly refers to a dynamic plan. The annual risk assessment is merely the minimum.
A good plan should therefore be set up so that it can be adjusted quickly, for example through a periodic review (monthly or quarterly). Changes in strategy, risks, systems or the organisation can be a reason to bring audits forward, postpone them, replace them or adjust their scope.
An internal audit plan is therefore more a rolling portfolio of assurance priorities than a fixed twelve-month calendar.
Professional judgement remains decisive
Risk scores, stakeholder interviews, previous audits and assurance maps provide important input. But an internal audit plan is ultimately not a mathematical outcome.
The essence is the CAE’s professional judgement about where Internal Audit, with scarce capacity, can provide the most relevant assurance and insight.
A strong audit plan therefore shows logically: what the organisation wants to achieve, which risks threaten that, where assurance is needed, which assurance is already available and why Internal Audit does or does not examine certain topics.
The internal audit plan is then not simply a list of audits, but an important instrument for the organisation’s governance, with the focus on using audit capacity effectively.