Developing a Risk-Based Audit Plan

Introduction
Developing a risk-based audit plan is one of the most heavily tested topics in the Internal Audit Operations domain of the CIA Challenge Exam. It sits at the heart of how an internal audit activity (IAA) decides where to spend its limited resources. Under the Institute of Internal Auditors' (IIA) Global Internal Audit Standards (2024) and the earlier International Professional Practices Framework (IPPF), the Chief Audit Executive (CAE) must create a plan that reflects the organization's strategy, objectives and most significant risks.

Why Developing a Risk-Based Audit Plan Is Important
1. Alignment with organizational objectives: A risk-based plan ensures internal audit focuses on the areas that matter most to achieving the organization's goals, so the IAA adds value instead of performing routine, low-impact work.
2. Efficient use of limited resources: Internal audit never has enough staff, time or budget to audit everything. Risk-based planning puts resources where the exposure is greatest.
3. Supports governance and assurance: The board and senior management rely on internal audit for independent assurance over risk management, control and governance processes. A plan based on risk gives them confidence that key exposures are covered.
4. Compliance with the Standards: The IIA Standards (Standard 9.4 Internal Audit Plan in the 2024 Global Internal Audit Standards, formerly Standard 2010 Planning) require the CAE to establish a risk-based plan, at least annually, to determine the priorities of the IAA.
5. Responsiveness to change: Because the plan is reviewed and adjusted as risks evolve, internal audit stays relevant in a dynamic business environment.
6. Credibility and stakeholder trust: When stakeholders see that audit priorities are driven by a sound, documented risk assessment, the IAA's credibility and influence grow.

What a Risk-Based Audit Plan Is
A risk-based audit plan is a document, usually covering one year though some organizations use multi-year or rolling plans, that sets out the engagements and other activities internal audit will perform. It rests on a documented assessment of risks across the audit universe.

Key components include:
- Audit universe: A complete list of all auditable entities, such as business units, processes, functions, systems, locations, projects and subsidiaries.
- Risk assessment: An evaluation of the inherent and residual risks associated with each auditable entity.
- Prioritized list of engagements: Assurance and consulting engagements ranked by risk.
- Resource requirements: Staff hours, competencies, budget, technology and any co-sourcing or outsourcing needs.
- Rationale: Why each engagement was selected and how it links to organizational objectives and key risks.
- Coordination with other assurance providers: How the plan considers work done by external auditors, compliance, risk management and other second-line functions (the Three Lines Model).
- Flexibility: Contingency time for emerging risks, special requests and unplanned investigations.

How It Works: The Step-by-Step Process

Step 1: Understand the organization
The CAE gains a thorough understanding of the organization's strategy, objectives, business model, industry, regulatory environment and culture. This involves reviewing strategic plans, board minutes, financial reports and risk registers.

Step 2: Consult with stakeholders
The CAE must consider input from senior management and the board. This includes interviews and surveys with executives, board and audit committee members, and operational managers. The 2024 Standards stress understanding stakeholder expectations and the organization's governance, risk management and control processes.

Step 3: Define or update the audit universe
The CAE identifies all potential auditable areas. The audit universe should be comprehensive and updated regularly to reflect new products, acquisitions, systems and processes.

Step 4: Perform a risk assessment
Each auditable entity is assessed using risk factors such as:
- Financial materiality and transaction volume
- Complexity of operations
- Regulatory and compliance requirements
- Changes in personnel, systems or processes
- Results of prior audits and time since the last audit
- Quality of internal controls
- Fraud risk
- Reputational impact
- Information technology and cybersecurity exposure
- Strategic significance

Risks are typically scored on impact (significance) and likelihood, and sometimes velocity. If the organization has a mature Enterprise Risk Management (ERM) framework, the CAE should use management's risk assessment as a starting point but must still apply independent judgment. Where no formal risk management exists, the CAE uses his or her own judgment after consulting management and the board.

Step 5: Prioritize and select engagements
Auditable entities are ranked by risk score. High-risk areas are scheduled for audit, often annually. Medium-risk areas may be covered on a cyclical basis, and low-risk areas less frequently. Mandatory engagements, such as regulatory requirements, are included regardless of score.

Step 6: Consider assurance coverage from other providers
The CAE considers reliance on other internal and external assurance providers to avoid duplication and gaps. This is often shown through assurance mapping.

Step 7: Determine resource needs
The CAE compares the resources needed to execute the plan with the resources available. If there is a shortfall, the CAE has three options:
- Seek additional resources, such as budget, staff or co-sourcing.
- Communicate the impact of the limitation to senior management and the board.
- Adjust the plan by deferring lower-risk engagements.

Step 8: Include consulting engagements
When accepting proposed consulting engagements, the CAE should consider their potential to improve risk management, add value and improve operations. Accepted engagements should be included in the plan.

Step 9: Communicate and obtain approval
The CAE communicates the plan and resource requirements, including significant interim changes, to senior management and the board for review and approval. The board approves; senior management reviews and provides input. The CAE must also communicate the impact of any resource limitations.

Step 10: Monitor and update the plan
The plan is a living document. The CAE reviews and adjusts it as necessary in response to changes in the organization's business, risks, operations, programs, systems and controls. Significant changes require communication to, and approval by, the board.

Key Concepts to Remember
- Inherent risk: Risk before considering controls.
- Residual risk: Risk remaining after management's response and controls.
- Risk appetite: The level of risk the organization is willing to accept in pursuit of its objectives.
- Audit universe vs. audit plan: The universe is everything that could be audited. The plan is what will be audited in the period.
- Annual vs. rolling plans: The Standards require review at least annually, but many IAAs use dynamic or rolling plans, such as quarterly updates, to stay agile.
- Independence: Management can provide input, but the CAE owns the plan. Management should not dictate or restrict audit scope.
- Board approval: The board (or audit committee) is the final approver of the internal audit plan.

Common Pitfalls in Practice (and in Exam Distractors)
- Building the plan only from the previous year's plan, a cyclical approach with no risk assessment.
- Letting management unilaterally choose which areas to audit.
- Relying fully on management's risk assessment without independent evaluation.
- Failing to communicate resource shortfalls to the board.
- Not leaving flexibility for emerging risks.
- Ignoring strategic and emerging risks such as cybersecurity, ESG and AI in favor of only financial risks.

Exam Tips: Answering Questions on Developing a Risk-Based Audit Plan

1. Always think risk first. When a question asks what the CAE should do first or what the primary basis of the audit plan is, the answer is almost always tied to a documented risk assessment or understanding organizational objectives and risks. Avoid answers based solely on prior audits, rotation schedules or management requests.

2. Know who approves the plan. The board approves the internal audit plan. Senior management reviews it and provides input. If a choice says senior management approves the plan, it is usually a distractor, unless no board option is offered.

3. Know the response to resource limitations. If resources are insufficient, the CAE must communicate the impact of resource limitations to senior management and the board. Answers like quietly reducing scope or simply working overtime are wrong.

4. Distinguish input from control. The CAE considers management's and the board's input, but the CAE develops the plan. Choices suggesting management decides audit areas violate independence.

5. Use ERM wisely. If the organization has a mature ERM process, the CAE leverages it but does not rely on it blindly. If ERM is absent, the CAE uses professional judgment after consulting stakeholders.

6. Remember the first step. Questions about sequence often test whether you know that understanding the organization's strategy and objectives, and then identifying the audit universe, come before scoring risks.

7. Watch for words like 'most', 'best', 'primary' and 'first'. Several options may be partly correct. Choose the one that most directly reflects IIA Standards language, such as risk-based, aligned with organizational objectives or board approval.

8. Consulting engagements belong in the plan. Accepted consulting engagements should be included in the plan if they add value and improve risk management and operations.

9. The plan is dynamic. If a scenario describes a major change, such as a merger, new regulation, cyber incident or new ERP system, the correct answer usually involves reassessing risks and updating the plan, with significant changes communicated to the board.

10. Coordinate and rely appropriately. Questions about external auditors or second-line functions test coordination. The CAE should share information and coordinate activities to ensure proper coverage and minimize duplication.

11. Eliminate extreme answers. Options with 'always audit everything', 'never deviate from the plan' or 'audit only financial areas' are typically wrong. The Standards favor judgment, flexibility and a comprehensive view of risk.

12. Link to value. When unsure, pick the answer that best shows internal audit adding value, protecting organizational value and aligning with strategy. This reflects the IIA's Purpose of Internal Auditing.

Sample Question Walkthrough
Question: Which of the following is the most appropriate basis for establishing the internal audit activity's annual plan?
A. The prior year's audit plan adjusted for inflation
B. Requests received from senior management
C. A documented risk assessment considering input from senior management and the board
D. A rotation schedule ensuring every unit is audited every three years

Answer: C. The Standards require the plan to be based on a documented risk assessment, performed at least annually, that considers stakeholder input. A, B and D are not risk-driven on their own.

Summary
A risk-based audit plan ensures internal audit focuses on the organization's most significant risks and objectives. It does so by understanding the organization, consulting stakeholders, defining the audit universe, assessing and prioritizing risks, aligning resources, coordinating with other assurance providers, obtaining board approval and updating the plan as conditions change. For the exam, anchor every answer in risk, independence, board approval, communication of resource limitations and flexibility.