How to Conduct an Internal Audit Risk Assessment: A Practical Step-by-Step Guide
Building a Risk-Based Internal Audit Plan That Focuses on What Matters Most
An effective Internal Audit Department cannot audit everything.
Organizations face financial, operational, compliance, cybersecurity, fraud, strategic, and governance risks. The number of potential audit subjects will almost always exceed the resources available to examine them.
The challenge for the Chief Audit Executive (CAE) is determining where Internal Audit can provide the greatest value.
That process begins with an internal audit risk assessment.
An internal audit risk assessment is a structured evaluation of the organization's activities, processes, systems, and risks to determine which areas should receive independent assurance and advisory attention.
It provides the foundation for a risk-based internal audit plan.
The objective is not simply to identify the areas with the largest financial balances or the most visible problems.
The objective is to determine where failures in governance, risk management, and internal controls could most significantly affect the organization's ability to achieve its objectives.
A well-designed internal audit risk assessment directs limited audit resources toward the risks that matter most to the organization.
1. Understand the Purpose of an Internal Audit Risk Assessment
An internal audit risk assessment helps the CAE answer five fundamental questions:
What are the organization's significant objectives?
What risks could prevent those objectives from being achieved?
Which organizational activities and controls address those risks?
Where is independent assurance most needed?
How should available audit resources be allocated?
The assessment connects organizational risk exposure to the internal audit plan.
It should also consider management's risk assessments, prior audit results, regulatory findings, emerging risks, and the expectations of the Board and senior management.
The assessment is not intended to replace management's enterprise risk management process.
Management owns and manages organizational risks.
Internal Audit independently evaluates those risks and uses its understanding to determine appropriate assurance coverage.
2. Understand the IIA's Risk-Based Planning Requirements
The IIA's Global Internal Audit Standards, effective January 9, 2025, establish important requirements for internal audit planning.
Standard 9.4 — Internal Audit Plan requires the CAE to create an internal audit plan that supports the achievement of organizational objectives.
The plan must be based on a documented assessment of the organization's strategies, objectives, and risks.
The assessment must be performed at least annually and informed by input from the Board and senior management.
The CAE must review and revise the plan as necessary in response to changes in the organization's business, risks, operations, programs, systems, and controls.
The CAE must also communicate the plan, including significant interim changes, to the Board and senior management.
The Board is responsible for approving the internal audit plan.
These requirements reinforce an important principle:
The internal audit plan should be driven by organizational risks, not merely by the audits performed in previous years.
3. Step One: Understand the Organization's Objectives
Risk cannot be evaluated effectively without understanding what the organization is trying to accomplish.
The CAE should begin by reviewing the organization's strategic and operational objectives.
Relevant sources may include:
Strategic plans.
Annual budgets.
Financial forecasts.
Business plans.
Regulatory requirements.
Board meeting materials.
Enterprise risk assessments.
Major projects and initiatives.
Performance dashboards.
Prior internal and external audit reports.
The CAE should also interview senior management and appropriate governance representatives.
For example, a community bank may have objectives involving loan growth, capital adequacy, liquidity, customer retention, and regulatory compliance.
A manufacturing company may focus on production efficiency, product quality, supply chain reliability, and profitability.
A school district may prioritize student achievement, enrollment stability, financial sustainability, and regulatory compliance.
The risk assessment should reflect the organization's actual objectives.
4. Step Two: Develop or Update the Internal Audit Universe
The internal audit universe is the organized inventory of activities, processes, functions, systems, entities, and other auditable subjects that Internal Audit may evaluate.
A well-designed audit universe helps the CAE identify potential coverage gaps.
An illustrative audit universe might include:
Audit universe category | Potential audit subjects |
Financial management | Revenue, accounts payable, payroll, treasury |
Operations | Procurement, inventory, production, service delivery |
Information technology | Cybersecurity, access controls, change management |
Compliance | Regulatory reporting, privacy, industry requirements |
Governance | Board reporting, ethics, conflicts of interest |
Human resources | Hiring, compensation, employee access |
Third-party management | Vendor onboarding, contracts, service providers |
Strategic initiatives | Capital projects, acquisitions, system implementations |
The audit universe should be tailored to the organization.
It should also be reviewed periodically as activities change.
A new business line, significant technology implementation, or organizational restructuring may create new auditable subjects.
The audit universe should not become a static spreadsheet that is updated only when the annual audit plan is prepared.
5. Step Three: Identify Significant Risks
Once the audit universe is established, the CAE should identify significant risks associated with each auditable area.
Common risk categories include:
Financial risk: Financial loss, reporting errors, liquidity problems, and asset misappropriation.
Operational risk: Process failures, business interruptions, inefficiencies, and inadequate service delivery.
Compliance risk: Violations of laws, regulations, contracts, or internal policies.
Cybersecurity risk: Unauthorized access, data breaches, ransomware, and technology disruptions.
Fraud risk: Corruption, financial reporting manipulation, and asset misappropriation.
Strategic risk: Failure to achieve important organizational objectives.
Governance risk: Ineffective oversight, inadequate accountability, and unreliable management reporting.
Risks should be described in a manner that supports evaluation.
For example: Inadequate controls over vendor banking changes may permit unauthorized payment redirection and financial loss.
This is more useful than simply identifying “accounts payable risk.”
The description identifies a potential cause, event, and consequence.
6. Step Four: Identify Sources of Risk Information
An effective risk assessment should not rely exclusively on management interviews.
Management perspectives are important, but they may not reveal every significant risk.
The CAE should consider multiple sources of information.
Source | Information provided |
Senior management interviews | Strategic and operational concerns |
Board and Audit Committee | Governance priorities and oversight concerns |
Enterprise risk assessments | Management's identified risk exposures |
Financial statements | Significant balances, trends, and financial risks |
Regulatory examinations | Compliance deficiencies and supervisory concerns |
Prior audit reports | Historical control weaknesses |
External auditor communications | Financial reporting and control concerns |
Fraud and ethics reports | Potential misconduct and control failures |
Cybersecurity reports | Technology threats and vulnerabilities |
Performance indicators | Operational trends and emerging problems |
Industry developments | External risks and changing conditions |
Internal Audit should evaluate the reliability and completeness of these sources.
For example, an enterprise risk register may provide valuable information, but it may also omit risks that management has not identified or has underestimated.
7. Step Five: Evaluate Inherent Risk
Inherent risk is the level of risk associated with an activity before considering the effects of controls.
The CAE may evaluate inherent risk using factors such as:
Financial exposure.
Operational complexity.
Transaction volume.
Regulatory sensitivity.
Fraud susceptibility.
Technology dependence.
Potential business disruption.
Reputational consequences.
Rate of organizational change.
A simple methodology may use a five-point rating scale.
Rating | Description |
1 | Very low risk |
2 | Low risk |
3 | Moderate risk |
4 | High risk |
5 | Very high risk |
Each rating should have defined criteria.
For example, a high financial impact rating might involve exposure capable of materially affecting liquidity or operating results.
The methodology should reflect the organization's size and risk profile.
A $500,000 potential loss may be relatively modest for a large financial institution but significant for a small nonprofit organization.
8. Step Six: Evaluate Likelihood and Impact
Many internal audit risk assessments evaluate risk using likelihood and impact.
Likelihood represents the estimated possibility that a risk event will occur.
Impact represents the potential consequences if it occurs.
A simple scoring model is: Risk Score = Likelihood × Impact
For example:
Likelihood: 4 out of 5.
Impact: 5 out of 5.
Illustrative score: 20 out of 25.
This approach can help prioritize discussions.
However, the CAE should recognize that ordinal ratings are not necessarily precise numerical measurements.
Multiplying likelihood and impact scores creates a prioritization index, not a statistically valid estimate of expected financial loss.
The methodology should also consider risks with severe consequences but relatively low likelihood.
For example, a catastrophic cybersecurity event may warrant audit attention even if its estimated likelihood is relatively low.
9. Step Seven: Evaluate the Control Environment
The CAE should consider the quality of management's risk management and internal control processes.
Relevant factors may include:
Results of previous audits.
Known control deficiencies.
Regulatory examination findings.
Management's corrective action performance.
Employee turnover.
Changes in key personnel.
Reliability of management reporting.
Quality of monitoring controls.
History of fraud or compliance violations.
The CAE should distinguish between inherent and residual risk.
Residual risk is the risk remaining after considering management's risk responses and controls.
However, an important caution applies.
A favorable control assessment should be supported by credible evidence.
Internal Audit should not assume that controls are effective simply because management reports that they exist.
If control effectiveness has not been independently evaluated, the risk assessment should reflect that uncertainty.
10. Step Eight: Consider Additional Audit Planning Factors
Likelihood and impact alone may not adequately determine audit priorities.
The CAE should consider additional factors, such as:
Time since the last audit: Areas that have not received assurance for an extended period may warrant additional attention.
Magnitude of change: New systems, leadership changes, reorganizations, and acquisitions can increase uncertainty.
Regulatory expectations: Certain activities may require recurring independent review.
Fraud exposure: Areas involving cash, vendor payments, payroll, or management override may present elevated fraud risks.
Quality of existing assurance: Reliable work by compliance functions, external auditors, or other assurance providers may affect Internal Audit's coverage strategy.
Management concerns: Significant operational issues may require timely evaluation.
Audit Committee concerns: Governance priorities should inform the risk assessment.
These factors should be applied consistently.
11. Step Nine: Develop a Risk Scoring Methodology
The CAE should establish a documented methodology for ranking auditable areas.
A weighted scoring model can help make the process transparent.
For illustration:
Risk factor | Weight |
Financial and operational impact | 25% |
Likelihood of significant failure | 20% |
Regulatory and compliance exposure | 20% |
Fraud susceptibility | 15% |
Control environment concerns | 10% |
Organizational change | 10% |
Total | 100% |
Each factor can be rated from 1 to 5.
The weighted score is calculated by multiplying each rating by its assigned weight and adding the results.
The methodology should be tailored to the organization.
Weights should reflect professional judgment, strategic objectives, and governance expectations.
here is no universal IIA-mandated risk scoring formula.
12. Example: Risk Assessment of an Internal Audit Universe
Consider a hypothetical organization with the following auditable areas.
The ratings below are illustrative weighted risk scores on a five-point scale.
Auditable area | Risk score | Illustrative priority |
Cybersecurity | 4.8 | Critical |
Cash management and liquidity | 4.6 | Critical |
Vendor master file controls | 4.4 | High |
Regulatory compliance | 4.3 | High |
Payroll | 3.7 | Moderate |
Inventory management | 3.5 | Moderate |
Travel and expense reporting | 2.4 | Low |
Office administration | 1.8 | Low |
These scores can help the CAE identify areas requiring greater attention.
However, the final audit plan should not be created simply by selecting the highest numerical scores.
The CAE must also consider the nature of the risks, regulatory requirements, existing assurance coverage, available resources, and the potential value of an engagement.
13. Step Ten: Translate Risk Priorities into Audit Engagements
A risk assessment becomes valuable when it influences the internal audit plan.
The CAE should translate risk priorities into specific assurance or advisory engagements.
For example:
High-risk area | Potential audit engagement |
Cybersecurity | Identity and access management audit |
Cash management | Treasury controls and liquidity reporting audit |
Vendor management | Vendor onboarding and banking change controls |
Regulatory compliance | Compliance program effectiveness audit |
Financial reporting | Journal entry and management override controls |
Information technology | Change management and system access audit |
Each proposed engagement should have a clear rationale connected to organizational risks.
The CAE should also consider whether the engagement can produce useful conclusions with available audit resources.
14. Step Eleven: Evaluate Internal Audit Resources
The risk assessment may identify more high-priority engagements than the department can perform.
The CAE should evaluate:
Available auditor hours.
Personnel competencies.
Specialized technology expertise.
Budget constraints.
Co-sourcing opportunities.
Regulatory commitments.
Follow-up responsibilities.
Unplanned investigation capacity.
An audit plan that exceeds available resources is not an effective plan.
The CAE should identify significant resource limitations and communicate their implications to the Board and senior management.
For example, if the department lacks cybersecurity expertise, the CAE may recommend co-sourcing the engagement with qualified specialists.
The Board should understand any significant risks that cannot receive the desired assurance coverage because of resource limitations.
15. Step Twelve: Present the Risk Assessment to the Audit Committee
The Audit Committee should receive more than a list of proposed audits.
The CAE should communicate the relationship between organizational risks and the proposed internal audit plan.
A useful presentation may include:
The risk assessment methodology.
Significant organizational risks.
Changes from the previous assessment.
The highest-risk auditable areas.
Proposed audit engagements.
Significant areas not included in the plan.
Available internal audit resources.
Competency or budget limitations.
Coordination with other assurance providers.
Proposed procedures for updating the plan.
The Audit Committee should challenge the methodology and assumptions.
Important questions include:
Are the highest organizational risks adequately represented?
Have significant emerging risks been considered?
Are management's risk assessments reliable?
Are important governance risks receiving sufficient attention?
Does Internal Audit have the necessary competencies?
What risks will remain without planned assurance coverage?
The Board's approval of the internal audit plan should be informed by these considerations.
16. Step Thirteen: Update the Risk Assessment Throughout the Year
A risk assessment should not become obsolete immediately after the annual plan is approved.
Organizations experience changes involving:
New regulations.
Cybersecurity incidents.
Major acquisitions.
Financial deterioration.
Fraud allegations.
Leadership changes.
Technology implementations.
Significant operational disruptions.
The CAE should monitor these developments and revise the audit plan when necessary.
For example, a significant deterioration in liquidity may justify changing the audit plan to prioritize cash management and financial forecasting controls.
Likewise, a major cybersecurity incident may require immediate assurance or advisory attention.
A risk-based plan should be dynamic.
17. Common Internal Audit Risk Assessment Mistakes
Several recurring problems can undermine the quality of risk-based planning.
Using last year's audit plan as the starting point: Repeating engagements without reconsidering organizational risks.
Failing to understand strategic objectives: Evaluating processes without understanding their importance.
Relying entirely on management: Accepting management's risk assessments without independent evaluation.
Using arbitrary risk scores: Assigning ratings without defined criteria.
Ignoring governance risks: Focusing only on transactions while overlooking Board reporting and accountability.
Overlooking fraud: Failing to consider intentional misconduct and management override.
Assuming controls are effective: Reducing risk ratings without sufficient evidence.
Ignoring emerging risks: Failing to respond to technology, regulatory, and market changes.
Failing to consider resources: Developing an audit plan that cannot realistically be completed.
Providing insufficient information to the Audit Committee: Requesting approval without explaining risk coverage and limitations.
The CAE should periodically evaluate whether the methodology is producing useful audit planning decisions.
18. How AI Can Improve Internal Audit Risk Assessments
Artificial intelligence can support the risk assessment process by helping auditors analyze large amounts of organizational information.
Potential applications include:
Financial trend analysis: Identifying unusual changes in revenue, expenses, cash balances, and operating performance.
Regulatory analysis: Summarizing relevant regulatory developments and potential compliance implications.
Audit report analysis: Identifying recurring deficiencies and unresolved control weaknesses.
Fraud risk analysis: Highlighting unusual transaction patterns and potential fraud indicators.
Risk identification: Suggesting potential risks based on organizational activities and industry characteristics.
Management reporting analysis: Comparing risk information across reports and periods.
Audit universe maintenance: Identifying new systems, processes, and organizational activities.
AI-generated risk assessments should be treated as analytical inputs rather than authoritative conclusions.
The CAE should validate material information, protect confidential data, and retain responsibility for professional judgments.
AI can improve efficiency, but it cannot replace the auditor's understanding of the organization.
19. A Practical Internal Audit Risk Assessment Workpaper
The CAE should maintain documentation supporting the assessment.
A useful workpaper may include:
Field | Description |
Auditable area | Process, function, system, or entity |
Organizational objective | Objective supported by the activity |
Significant risks | Events or conditions affecting objectives |
Risk owner | Responsible management individual |
Inherent risk | Risk before considering controls |
Control effectiveness | Available evidence concerning control performance |
Residual risk | Risk remaining after controls |
Regulatory exposure | Applicable compliance requirements |
Fraud risk | Relevant fraud scenarios |
Prior audit results | Historical findings and assurance |
Organizational change | Significant changes affecting risk |
Overall priority | Documented risk assessment conclusion |
Proposed engagement | Recommended audit coverage |
Planning rationale | Reason for including or excluding the area |
The workpaper should provide sufficient information for an experienced auditor to understand how the risk assessment influenced the internal audit plan.
20. Internal Audit Risk Assessment Checklist
Before submitting the audit plan for approval, the CAE should consider the following questions:
Have the organization's significant objectives been identified?
Is the internal audit universe reasonably complete?
Have significant risks been identified for each relevant auditable area?
Has input been obtained from senior management and the Board?
Have prior audit and regulatory findings been considered?
Have fraud and cybersecurity risks been evaluated?
Are risk ratings supported by defined criteria?
Has management's control environment been considered?
Have emerging risks and organizational changes been evaluated?
Are significant governance risks included?
Have other assurance providers been considered?
Are proposed engagements connected to identified risks?
Are sufficient resources available?
Have material coverage gaps been communicated?
Has the Board approved the internal audit plan?
Is there a process for updating the plan when risks change?
The Bottom Line
An internal audit risk assessment is one of the most important responsibilities of the Chief Audit Executive.
It determines where the Internal Audit Department directs its limited resources and whether the function provides assurance over the organization's most significant risks.
A strong assessment begins with organizational objectives, uses a comprehensive audit universe, evaluates significant risks, considers the effectiveness of controls, and incorporates input from management and the Board.
The results should support a documented, defensible, and dynamic internal audit plan.
But the assessment should not become a mechanical scoring exercise.
The purpose of an internal audit risk assessment is not to produce a spreadsheet full of risk scores. It is to ensure that Internal Audit focuses on the areas where independent assurance can make the greatest difference.
When performed effectively, risk assessment strengthens governance, improves audit planning, and helps Internal Audit fulfill its responsibility to provide independent assurance concerning risk management and internal controls.
Strengthen Your Internal Audit Skills with Corporate Compliance Seminars
Corporate Compliance Seminars provides continuing professional education for internal auditors, external auditors, compliance professionals, risk managers, and Audit Committee members.
Our training programs address risk-based audit planning, internal control evaluation, audit evidence, fraud risk assessment, governance, and the IIA's Global Internal Audit Standards.
Explore available training at Corporate Compliance Seminars.
Comments