Communicating the Audit Plan and Subsequent Changes: A Complete CIA Exam Guide
Overview
Once the chief audit executive (CAE) has built a risk-based internal audit plan, the work is not finished. The plan must be communicated to senior management and the board, the board must approve it, and any significant changes made during the year must be communicated again. This topic sits at the point where planning meets governance. It is a frequent source of exam questions because it tests whether you know who receives the plan, what must be included, who approves it and when changes must be reported.
1. Why It Is Important
Board oversight and accountability: The board, usually through the audit committee, oversees the internal audit function. It cannot oversee the function properly unless it knows what internal audit plans to cover and what it will not cover.
Independence: When the board approves the plan, the CAE's work rests on the board's authority rather than on management's preferences. This reduces the risk that management limits the scope of audits that affect its own areas.
Alignment with organizational risk: Communicating the plan gives senior management and the board a chance to confirm that internal audit is focused on the risks they consider most significant.
Resource transparency: The board must understand whether internal audit has enough budget, staff and skills. If resources fall short, the board needs to know which risks will go unaddressed so it can decide whether to accept that risk or provide more resources.
Credibility and trust: Changing the plan without telling anyone undermines confidence in internal audit. Transparent communication of changes keeps stakeholders informed and protects the function's credibility.
Conformance with the Standards: Communicating and obtaining approval of the plan is a requirement of the IIA's Global Internal Audit Standards. Failing to do so is a conformance gap that a quality assessment would identify.
2. What It Is
Communicating the audit plan means formally presenting the internal audit plan, together with its supporting information, to senior management and the board. It is done for the following purposes:
• Senior management reviews the plan and provides input.
• The board discusses and approves the plan.
Under the Global Internal Audit Standards (Standard 9.4, Internal Audit Plan, and related standards such as 8.1 Board Interaction and 8.2 Resources), the CAE must:
• Develop a risk-based plan and present it to the board and senior management.
• Communicate the internal audit resource requirements.
• Seek board approval of the plan and the related budget and resources.
• Review and revise the plan as needed, communicating significant changes in a timely way.
• Communicate the impact of any resource limitations on internal audit coverage.
Note on older wording: The previous IPPF Standard 2020, Communication and Approval, stated that the CAE must communicate the activity's plans and resource requirements, including significant interim changes, to senior management and the board for review and approval. It also required the CAE to communicate the impact of resource limitations. Exam questions may use either version, but the core ideas are the same.
Typical contents of the communication:
• The planned engagements, including assurance and advisory work, with their objectives and timing.
• The basis for the plan: the risk assessment, the audit universe, and links to organizational strategy and objectives.
• Resource requirements, such as the number of staff, the competencies needed, the budget, technology and any use of co-sourcing or outsourcing.
• Areas not covered and the reasons why. This shows the board the residual coverage gaps.
• Coordination with other assurance providers, such as external audit, compliance and risk management.
• The plan's time frame (often annual, sometimes rolling or multi-year) and how frequently it will be reviewed.
3. How It Works
Step 1: Draft the plan. The CAE prepares the plan using a documented risk assessment. The assessment draws on input from senior management, the board and other stakeholders.
Step 2: Discuss with senior management. Senior management reviews the draft and comments on risks, priorities and timing. Management provides input. It does not have final approval authority.
Step 3: Present to the board for approval. The CAE presents the plan, the budget and the resource needs to the board or audit committee. The board discusses and then approves them. The board's approval gives the plan its authority.
Step 4: Communicate resource limitations. Sometimes the resources needed to cover the significant risks exceed the resources available. In that case the CAE must clearly explain the effect, meaning which high-risk areas will not be audited. The board then decides whether to accept the risk or provide more resources. The CAE does not quietly drop the areas from the plan.
Step 5: Monitor and revise. The plan is a dynamic document. The CAE reviews it regularly, and many organizations do this quarterly or on a rolling basis. Revisions may be triggered by:
• New or emerging risks, such as cyber threats, fraud allegations or regulatory changes.
• Changes in the business, such as mergers, acquisitions, new systems, restructuring or new products.
• Changes in internal audit resources, such as staff turnover, budget cuts or skill gaps.
• Special requests from senior management or the board.
• Results of completed engagements that reveal new concerns.
Step 6: Communicate significant changes. The CAE must communicate significant interim changes to senior management and the board in a timely manner for review and approval. Waiting for the next annual cycle is not acceptable. Minor scheduling adjustments, such as moving an audit a few weeks, usually do not need formal board approval. Changes that alter risk coverage do, such as adding or removing a high-risk engagement or reallocating significant resources.
Step 7: Report on progress. The CAE reports periodically on how the plan is being carried out. These reports compare actual work to the plan, explain deviations and give the status of resources.
Key distinctions to remember:
• Senior management reviews; the board approves.
• Significant changes require communication and approval. Minor changes generally do not.
• Resource shortfalls must be communicated together with their impact on coverage.
• The plan and its budget are approved by the board, not by the CEO or CFO alone.
4. Illustrative Scenarios
Scenario A: Midyear, the organization acquires a foreign subsidiary that carries significant compliance risk. The CAE wants to add an audit of the subsidiary and defer a lower-risk payroll audit.
Correct action: Update the plan and communicate the significant change to senior management and the board for approval promptly.
Scenario B: The CFO cuts internal audit's budget by 30%, so two high-risk engagements cannot be performed.
Correct action: Communicate the impact of the resource limitation to the board, explaining the uncovered risks so the board can decide what to do.
Scenario C: An engagement is moved from March to April because of the auditee's availability.
Correct action: This is a minor change. It can be handled within normal management of the plan and noted in progress reports. Board approval is not required.
Scenario D: The CEO asks the CAE to remove an audit of the CEO's pet project from the plan.
Correct action: This raises an independence concern. Removing an approved, risk-based engagement is a significant change that must go to the board. The CAE should not simply comply.
Exam Tips: Answering Questions on Communicating the Audit Plan and Subsequent Changes
Tip 1: Identify who approves. When a question asks who approves the internal audit plan or budget, the answer is the board (or audit committee). Distractors such as the CEO, the CFO, external auditors or senior management alone are wrong for approval.
Tip 2: Separate review from approval. Senior management reviews and provides input. The board approves. If an option says the plan is communicated to senior management and the board for review and approval, it is usually correct.
Tip 3: Look for the word significant. Only significant interim changes must be communicated and approved. Rescheduling or small timing shifts are not significant. Changes that affect risk coverage, the scope of high-risk areas or resource allocation are significant.
Tip 4: Timeliness matters. Reject answers that suggest waiting until year-end or the next annual plan to report significant changes. The correct answer usually involves prompt or timely communication.
Tip 5: Resource limitations mean communicating the impact. When resources are insufficient, the best answer is that the CAE communicates the impact of the limitation, meaning the risks that will not be covered, to senior management and the board. Weaker options include:
• Silently reducing scope.
• Lowering audit quality.
• Hiring staff without approval.
• Asking management to accept the reduced scope informally.
Tip 6: Protect independence. If management pressures the CAE to remove or limit an audit, the best answer involves escalating to or informing the board. Avoid answers where the CAE simply agrees or simply refuses without involving the board.
Tip 7: The plan is dynamic. Answers that treat the plan as fixed for the year are usually wrong. Look for options that reflect ongoing review in response to changing risks.
Tip 8: Link the plan to risk and strategy. The best answers describing what to communicate tie the plan to the risk assessment and to organizational objectives, not just to a list of audits or prior-year rotation.
Tip 9: Choose the most complete answer. CIA questions often have several partly correct options. Pick the one that covers the following:
• Communicating to both senior management and the board.
• Including resource requirements.
• Obtaining board approval.
• Addressing the impact of limitations or changes.
Tip 10: Watch for traps.
• External auditors approving the plan: wrong. They may coordinate, but they do not approve.
• The CAE approving the plan alone: wrong.
• Communicating only to the CEO: incomplete.
• Hiding coverage gaps to avoid concern: wrong.
Practice Question Example
During the year, a CAE determines that budget cuts will prevent completion of three high-risk engagements in the approved plan. What should the CAE do first?
A. Reduce the scope of all remaining engagements equally.
B. Communicate the impact of the resource limitation to senior management and the board.
C. Defer the engagements to next year's plan without comment.
D. Ask the external auditor to cover the engagements.
Answer: B. The Standards require the CAE to communicate the impact of resource limitations and significant changes to senior management and the board so they can make informed decisions.
Summary
The CAE communicates the risk-based plan and its resource requirements to senior management for input and to the board for approval. The plan is monitored continuously. Significant changes and resource limitations, along with their impact on coverage, are communicated promptly for review and approval. On the exam, think board approval, significant changes, timely communication, impact of limitations and independence.
