Internal Audit Planning: From Risk Assessment to Audit Program
A Practical Guide to Building Risk-Based Internal Audit Plans and Effective Audit Programs
An effective internal audit department does not begin its work by selecting transactions or completing audit checklists.
It begins by understanding the organization's objectives, identifying significant risks, and determining where independent assurance can provide the greatest value.
The challenge is converting that understanding into a practical audit plan and then into specific audit procedures.
Many internal audit departments perform risk assessments, prepare annual audit plans, and develop audit programs. However, these activities are not always effectively connected.
An organization may have a comprehensive risk register but an audit plan that does not address its most significant risks.
An audit plan may identify cybersecurity as a priority but provide little explanation of which cybersecurity risks will be evaluated.
An audit program may contain dozens of procedures without demonstrating how those procedures address the engagement's objectives.
Effective internal audit planning requires a clear connection between organizational objectives, risks, audit priorities, engagement objectives, control testing, and audit conclusions.
This article explains how to establish that connection.
1. Understand the Three Levels of Internal Audit Planning
Internal audit planning operates at three related levels.
Planning level | Primary question | Principal deliverable |
Organizational risk assessment | What could prevent the organization from achieving its objectives? | Documented assessment of significant risks |
Risk-based internal audit plan | Where should Internal Audit devote its resources? | Board-approved internal audit plan |
Individual engagement audit program | What procedures will auditors perform to evaluate the selected risks? | Documented engagement work program |
These levels serve different purposes.
The organizational risk assessment identifies and evaluates risks.
The internal audit plan determines which areas Internal Audit will examine, considering risk significance, existing assurance, and available resources.
The engagement audit program translates selected risks into specific procedures for obtaining and evaluating evidence.
The three levels should be connected through a documented methodology.
2. Start With Organizational Objectives
Risk assessment should begin with the organization's objectives rather than a list of departments.
For example, a financial institution may have objectives involving:
Maintaining adequate capital and liquidity.
Complying with banking regulations.
Protecting customer information.
Preventing fraud and financial crime.
Maintaining reliable financial reporting.
Delivering effective customer service.
A manufacturer may focus on production quality, supply chain resilience, inventory management, financial reporting, and workplace safety.
A school district may emphasize student achievement, regulatory compliance, financial sustainability, student safety, and effective use of public resources.
The auditor should understand what the organization is trying to accomplish before identifying what could go wrong.
This approach helps prevent Internal Audit from becoming a routine compliance-checking function disconnected from organizational strategy.
3. Develop and Maintain the Internal Audit Universe
The internal audit universe identifies the activities, processes, systems, organizational units, and other areas that may be subject to audit.
A typical audit universe might include:
Category | Potential auditable areas |
Governance | Board reporting, ethics, enterprise risk management |
Financial | Cash, payroll, revenue, financial reporting |
Operational | Purchasing, inventory, production, logistics |
Compliance | Regulatory reporting, privacy, industry requirements |
Information technology | Cybersecurity, access controls, change management |
Human resources | Hiring, compensation, employee benefits |
Third parties | Vendor onboarding, contracts, outsourced services |
Strategic | Major projects, acquisitions, business transformation |
The audit universe should be updated as the organization changes.
New systems, products, regulations, facilities, and business activities may create additional risks.
An outdated audit universe can result in important activities being omitted from the risk assessment.
4. Identify the Significant Risks
For each auditable area, Internal Audit should identify the risks that could affect organizational objectives.
For example, consider vendor master data management.
Potential risks include:
Fictitious vendors.
Unauthorized changes to banking information.
Duplicate payments.
Employee-vendor conflicts of interest.
Inaccurate tax identification information.
Inappropriate system access.
Incomplete audit trails.
These risks are more useful than simply identifying “accounts payable” as an audit topic.
They explain what the auditor may need to evaluate.
Risks should be sufficiently specific to support the development of audit objectives and procedures.
5. Assess Inherent and Residual Risk
Internal auditors should distinguish between inherent risk and residual risk.
Inherent risk is the level of risk before considering the effect of controls or other risk responses.
Residual risk is the risk remaining after considering those responses.
For example, unauthorized vendor banking changes may present a high inherent fraud risk.
Management may implement independent callback verification, restricted access, dual approvals, and monitoring.
These controls may reduce residual risk if they are appropriately designed and operating effectively.
However, Internal Audit should not assume that controls are effective simply because management reports that they exist.
When the effectiveness of controls has not been independently established, the risk assessment should identify that uncertainty.
6. Establish a Consistent Risk Scoring Methodology
A risk scoring model can help prioritize the audit universe.
Common criteria include:
Financial impact.
Operational impact.
Regulatory exposure.
Fraud exposure.
Likelihood.
Technology dependence.
Rate of organizational change.
Control concerns.
Reputational consequences.
For example, a five-point scoring scale might be used.
Score | Illustrative impact assessment |
1 | Minimal |
2 | Low |
3 | Moderate |
4 | High |
5 | Severe |
The criteria should be defined so that different auditors apply them consistently.
A numerical risk score is a prioritization tool, not a precise statistical probability of loss.
Significant low-frequency risks should not be excluded merely because their calculated scores appear modest.
7. Convert Risk Assessment Results Into Audit Priorities
After completing the risk assessment, Internal Audit should rank potential engagements.
Consider the following hypothetical results.
Auditable area | Illustrative risk score | Potential audit priority |
Cybersecurity | 4.8 / 5 | Very high |
Cash management | 4.6 / 5 | Very high |
Vendor data management | 4.4 / 5 | High |
Regulatory compliance | 4.3 / 5 | High |
Payroll | 3.7 / 5 | Moderate |
Inventory | 3.5 / 5 | Moderate |
Travel expenses | 2.4 / 5 | Lower |
The highest-scoring areas will often receive greater attention.
However, audit selection should also consider:
Board and senior management concerns.
Recent significant changes.
Time since the last audit.
Regulatory expectations.
Results of prior engagements.
Management's remediation progress.
Assurance provided by other qualified functions.
Available audit resources and expertise.
Risk scores should inform professional judgment rather than replace it.
8. Build the Risk-Based Internal Audit Plan
The internal audit plan identifies the engagements Internal Audit intends to perform over a specified period.
The plan should be based on the documented assessment of organizational strategies, objectives, and risks.
Under the IIA Global Internal Audit Standards, Standard 9.4, Internal Audit Plan, addresses the requirements for establishing and maintaining a risk-based plan.
The chief audit executive must base the plan on a documented assessment of the organization's strategies, objectives, and risks, informed by input from the Board and senior management.
The risk assessment must be performed at least annually.
The internal audit plan should be reviewed and revised as necessary and communicated to the Board for approval.
The plan should also reflect the internal audit function's mandate and the resources required to fulfill it.
9. Estimate Audit Resources and Available Hours
An internal audit plan must be achievable.
The chief audit executive should determine the hours available for engagement work after considering other responsibilities.
Consider a hypothetical department with four auditors.
Resource calculation | Annual hours |
Four auditors × 2,080 hours | 8,320 |
Vacation, holidays, and leave | (1,120) |
Training and professional development | (320) |
Administration and departmental responsibilities | (800) |
Follow-up and special projects | (480) |
Available planned engagement hours | 5,600 |
These figures are illustrative.
The actual calculation should reflect staffing levels, employee availability, and departmental responsibilities.
An audit plan requiring 7,500 hours cannot be performed effectively with only 5,600 hours of available resources unless additional capacity is obtained or the plan is revised.
Unrealistic plans create pressure to reduce audit scope, rush testing, or omit important procedures.
10. Develop a Practical Annual Audit Schedule
Once resources are established, engagements can be scheduled.
For example:
Engagement | Estimated hours | Timing |
Cybersecurity | 800 | First quarter |
Cash management | 500 | First quarter |
Vendor data management | 600 | Second quarter |
Regulatory compliance | 700 | Second quarter |
Payroll | 450 | Third quarter |
Inventory | 450 | Third quarter |
Financial reporting controls | 600 | Fourth quarter |
Governance and risk management | 500 | Fourth quarter |
Total scheduled hours | 4,600 |
In this example, the department retains 1,000 hours of its 5,600-hour planned engagement capacity for emerging risks, special requests, and adjustments.
The schedule should reflect the availability of personnel with the appropriate knowledge and skills.
Highly specialized areas may require external expertise or co-sourcing.
11. Obtain Board Approval of the Internal Audit Plan
The chief audit executive should present the risk-based internal audit plan to the Board or Audit Committee, as appropriate under the organization's governance arrangements.
The presentation should include:
The risk assessment methodology.
Significant organizational risks.
Proposed audit engagements.
Engagement priorities.
Estimated resources.
Areas not included in the plan.
Significant coverage limitations.
Resource constraints.
Proposed use of external specialists.
Procedures for updating the plan.
The Board should understand the consequences of resource limitations.
If significant risks cannot be adequately covered, those limitations should be clearly communicated.
Approval of the plan does not transfer management's responsibility for risk management and internal control to Internal Audit.
Management remains responsible for operating effective controls.
Internal Audit provides independent assurance and advice.
12. Move From the Audit Plan to Individual Engagement Planning
An approved annual audit plan identifies what Internal Audit intends to examine.
It does not replace the planning required for each engagement.
Before beginning an individual audit, the team should develop an understanding of the specific activity under review.
Under the IIA Global Internal Audit Standards, engagement planning includes:
Standard 13.1 — Engagement Communication
Standard 13.2 — Engagement Risk Assessment
Standard 13.3 — Engagement Objectives and Scope
Standard 13.4 — Evaluation Criteria
Standard 13.5 — Engagement Resources
Standard 13.6 — Work Program
These standards establish a disciplined process for moving from broad audit priorities to specific engagement procedures.
13. Perform an Engagement-Level Risk Assessment
The organization-wide risk assessment may identify vendor data management as a high-priority audit area.
However, the engagement team must determine which specific risks warrant testing.
For example:
Vendor management activity | Specific risk |
Vendor onboarding | Fictitious or unauthorized vendors |
Tax identification validation | Incorrect vendor tax information |
Banking changes | Fraudulent payment diversion |
Vendor master access | Unauthorized data modifications |
Duplicate detection | Duplicate vendors and payments |
Inactive vendor management | Improper use of dormant vendor accounts |
The engagement-level risk assessment should consider the activity's objectives, significant risks, and relevant controls.
The auditor should also evaluate changes since the annual risk assessment.
For example, a recent business email compromise incident may increase the priority of testing vendor banking changes.
14. Establish Clear Engagement Objectives
Engagement objectives explain what the audit is intended to accomplish.
Weak objective: “Review vendor management.”
Stronger objective: “Evaluate whether controls over vendor onboarding, banking information changes, and vendor master file access are adequately designed and operating effectively to prevent or detect unauthorized vendor activity.”
The stronger objective identifies the activities and control outcomes being evaluated.
Engagement objectives should be sufficiently specific to guide audit procedures and support meaningful conclusions.
15. Define the Audit Scope
The scope identifies the boundaries of the engagement.
It may include:
Organizational units.
Locations.
Business processes.
Information systems.
Transaction types.
Time periods.
Third-party activities.
For example:
“The engagement will examine vendor onboarding, changes to vendor banking information, and vendor master access controls for the period January 1 through December 31, 2026, across the organization's principal accounts payable system.”
The scope should be sufficient to accomplish the engagement objectives.
If important activities are excluded, the auditor should document the rationale and evaluate whether the limitations affect the ability to reach conclusions.
16. Identify the Controls That Address Each Risk
The next step is to connect risks to control activities.
Consider vendor banking changes.
Risk: A fraudulent request causes payments to be redirected to an unauthorized bank account.
Potential controls include:
Independent verification using previously established contact information.
Dual approval of banking changes.
Restricted system access.
Retention of supporting documentation.
Automated change logs.
Periodic review of high-risk changes.
The auditor should determine which controls are relevant to the engagement objectives.
Not every control requires testing.
The selection should reflect the significance of the risk and the assurance needed.
17. Develop a Risk and Control Matrix
A risk and control matrix connects engagement objectives, risks, controls, and planned procedures.
Risk | Control | Audit objective | Planned test |
Fictitious vendor | Independent vendor approval | Determine whether new vendors are authorized | Test selected onboarding records |
Fraudulent bank change | Independent callback verification | Determine whether changes are authenticated | Examine verification evidence |
Unauthorized master file access | Role-based access | Determine whether access is restricted | Review user permissions |
Duplicate vendor | Duplicate detection process | Determine whether duplicate records are identified | Analyze vendor master data |
Undocumented changes | Change log monitoring | Determine whether changes are traceable | Inspect logs and review evidence |
The matrix provides a practical bridge between the risk assessment and the audit program.
It also helps reviewers identify risks that have not been addressed by planned procedures.
18. Translate the Matrix Into an Audit Work Program
The audit work program identifies the procedures necessary to achieve the engagement objectives.
Under IIA Standard 13.6, the work program should be developed and documented to achieve the engagement objectives.
It should identify criteria for evaluating each objective, tasks to be performed, methodologies, tools, and assigned internal auditors.
The work program must be reviewed and approved by the chief audit executive or designee before implementation and when significant changes are made.
Consider the following example.
Vendor Banking Change Audit Program
Objective: Determine whether changes to vendor banking information are appropriately authenticated, authorized, and documented.
Procedure 1 — Obtain the population
Obtain the complete population of vendor banking changes during the audit period.
Evaluate the reliability and completeness of the population.
Procedure 2 — Select transactions
Select transactions using an approach appropriate to the engagement objective, risk, population, and intended conclusions.
Procedure 3 — Verify authentication
For selected changes, determine whether independent verification was performed using established contact information.
Procedure 4 — Evaluate authorization
Determine whether the change received the required approval before implementation.
Procedure 5 — Review supporting documentation
Inspect change requests, verification records, approvals, and relevant system logs.
Procedure 6 — Investigate exceptions
Evaluate missing approvals, unusual timing, incomplete verification, and other deviations.
Procedure 7 — Form a conclusion
Determine whether the evidence supports a conclusion about the design and operating effectiveness of the relevant controls.
This program is more effective than a generic instruction to “review vendor changes.”
19. Distinguish Between Tests of Design and Operating Effectiveness
An internal audit program should distinguish two important control-testing objectives.
Design effectiveness
Does the control, if performed as intended, adequately address the identified risk?
For example, a vendor banking change process may require independent verification.
The auditor should determine whether the verification procedure is designed to reduce the risk of fraudulent changes.
Operating effectiveness
Was the control performed consistently, by appropriate personnel, and at the required time?
For example, the auditor may examine selected banking changes to determine whether independent verification actually occurred.
A control may be well designed but not performed.
Alternatively, a control may be consistently performed but inadequately designed.
Both situations may create significant risk.
20. Determine Appropriate Sampling and Testing Methods
The audit program should identify the testing method appropriate for the objective.
Possible methods include:
Inquiry.
Observation.
Inspection.
Reperformance.
Data analytics.
Transaction testing.
Attribute sampling.
Analytical procedures.
For example, attribute sampling may be appropriate when evaluating whether a control was performed for a population of transactions.
The auditor should consider:
Population size.
Control frequency.
Expected deviations.
Tolerable deviations.
Desired assurance.
Sampling risk.
Method of selection.
Sample sizes should not be chosen solely because the department has historically tested 25 or 40 transactions.
The methodology should be appropriate to the audit objective and the intended conclusions.
21. Evaluate Audit Evidence
An effective audit program specifies not only what procedures to perform but also what evidence is needed.
The IIA Global Internal Audit Standards require auditors to gather information that is relevant, reliable, and sufficient to achieve engagement objectives.
For example, management may state that all vendor banking changes receive independent verification.
That statement alone may not provide sufficient evidence.
The auditor should inspect appropriate records and evaluate whether the required verification occurred.
Where exceptions are identified, additional procedures may be necessary.
The quality of evidence is more important than the number of workpapers completed.
22. Develop Findings That Connect Risk, Control, and Consequence
When audit procedures identify a deficiency, the auditor should evaluate the condition against established criteria.
A well-developed audit finding generally addresses:
Criteria: What should occur?
Condition: What actually occurred?
Cause: Why did the difference occur, when determinable?
Effect or risk: What is the consequence or potential exposure?
Management action plan: What should be done?
For example:
Criteria: Vendor banking changes require independent callback verification.
Condition: Four of 30 selected changes lacked documented verification.
Cause: The approval workflow did not require completion of a verification field before processing.
Risk: Unauthorized banking changes could result in fraudulent payments.
Management action: Implement a mandatory verification workflow with documented evidence and independent approval.
The finding should distinguish between observed facts and potential consequences.
An exception does not automatically establish that fraud occurred.
23. Link Audit Conclusions Back to the Engagement Objectives
The final audit conclusion should address the objectives established during engagement planning.
If the objective was to evaluate vendor banking change controls, the conclusion should explain whether those controls were adequately designed and operating effectively, based on the evidence obtained.
The auditor should consider:
The significance of identified deficiencies.
The extent of testing.
The reliability of evidence.
The possibility of additional undetected problems.
Any scope limitations.
Management's corrective actions.
The conclusion should not be broader than the evidence supports.
For example, testing vendor banking changes does not automatically support a conclusion that the entire accounts payable process is effective.
24. Use Audit Results to Update the Risk Assessment
Internal audit planning should be a continuous cycle.
Engagement findings provide new information about organizational risks and control effectiveness.
For example, an audit may reveal that vendor banking change controls are ineffective.
That finding may increase the assessed residual risk for vendor management.
The chief audit executive may respond by:
Increasing monitoring.
Scheduling follow-up procedures.
Expanding audit coverage.
Evaluating related processes.
Reporting significant concerns to senior management and the Board.
Revising the internal audit plan.
The results of individual engagements should inform future risk assessments.
The audit plan should be a living document, not a schedule that remains unchanged regardless of emerging risks.
25. Using AI to Improve Internal Audit Planning
Artificial intelligence can assist auditors at several stages.
Organizational risk assessment
AI can help summarize regulatory developments, analyze risk registers, identify emerging risk themes, and compare historical audit findings.
Audit universe development
AI can help identify potentially missing auditable areas based on business activities, organizational structures, and applicable regulations.
Audit plan development
AI can assist with organizing risk priorities, comparing resource scenarios, and preparing Board reporting materials.
Engagement planning
AI can help develop preliminary risk and control matrices, identify possible control objectives, and draft audit program procedures.
Audit execution
AI can assist with analyzing transactions, identifying anomalies, summarizing documentation, and organizing exceptions.
However, auditors must validate AI-generated information and protect confidential organizational data.
AI-generated procedures should be reviewed by qualified auditors before inclusion in an approved audit program.
AI does not replace professional judgment, evidence evaluation, or supervisory review.
26. Common Mistakes in Internal Audit Planning
Internal audit departments should avoid several recurring weaknesses.
Starting with last year's audit plan: Repeating prior engagements without evaluating current risks.
Using an incomplete audit universe: Failing to consider new systems, services, and organizational changes.
Relying exclusively on management's risk ratings: Accepting risk assessments without independent challenge.
Selecting audits solely by numerical score: Ignoring significant low-frequency risks and Board concerns.
Preparing unrealistic schedules: Planning more work than available resources can support.
Using generic engagement objectives: Failing to identify what the audit should accomplish.
Copying old audit programs: Performing procedures that do not address current risks.
Testing controls without understanding their purpose: Completing procedures without evaluating the underlying risk.
Failing to investigate exceptions: Treating control deviations as administrative matters.
Drawing conclusions beyond the evidence: Reporting assurance that the procedures do not support.
Failing to update the plan: Ignoring significant changes or new information.
27. Internal Audit Planning Checklist
Before finalizing the annual audit plan and individual engagement programs, the chief audit executive and audit team should consider the following questions:
Have organizational objectives been identified?
Is the audit universe complete and current?
Have significant risks been identified?
Are inherent and residual risk considerations documented?
Is the risk scoring methodology consistent?
Have Board and senior management perspectives been considered?
Does the audit plan prioritize significant risks?
Are available resources sufficient?
Have significant coverage limitations been communicated?
Has the Board approved the internal audit plan?
Has each engagement received an appropriate risk assessment?
Are engagement objectives clearly defined?
Is the scope sufficient to accomplish the objectives?
Are relevant controls identified?
Does the risk and control matrix link risks to controls and procedures?
Is the work program approved before implementation?
Are sampling and testing methods appropriate?
Is the required evidence relevant, reliable, and sufficient?
Do engagement conclusions address the stated objectives?
Are audit results incorporated into future planning?
The Bottom Line: Every Audit Procedure Should Have a Risk-Based Purpose
Effective internal audit planning requires more than producing an annual schedule of engagements.
It requires a disciplined process connecting organizational objectives, significant risks, audit priorities, engagement objectives, control activities, testing procedures, evidence, and conclusions.
The organization-wide risk assessment identifies where risk exists.
The risk-based internal audit plan determines where independent assurance should be directed.
The engagement audit program specifies how auditors will evaluate the selected risks.
These activities must work together.
Every significant audit procedure should have a clear purpose, and that purpose should be connected to a risk, control, and engagement objective.
When this connection is documented and maintained, Internal Audit becomes more effective, efficient, and valuable to the organization.
That is the foundation of professional internal audit tradecraft.
Strengthen Your Internal Audit Planning Skills With Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides continuing professional education covering risk-based internal auditing, audit planning, internal control evaluation, audit evidence, fraud detection, and the IIA Global Internal Audit Standards.
Our programs help chief audit executives, audit managers, senior auditors, and staff auditors develop practical skills for building audit universes, performing risk assessments, creating audit plans, and designing effective audit programs.
Explore our internal auditing CPE programs at Corporate Compliance Seminars.
Comments