Keeping the Audit Plan Aligned with Strategy and Stakeholders

Keeping the Audit Plan Aligned with Strategy and Stakeholders (CIA Part 3: Internal Audit Plan)

Overview
Keeping the internal audit plan aligned with organizational strategy and stakeholder expectations is a core responsibility of the Chief Audit Executive (CAE). An audit plan is not a static document drawn up once a year and then forgotten. It is a living, risk-based roadmap. It must keep reflecting what the organization is trying to achieve, the risks that threaten those objectives, and the assurance and advisory needs of the board, senior management and other key stakeholders. In the CIA Part 3 exam, this topic sits within managing the internal audit activity and internal audit planning. It connects to the IIA's Global Internal Audit Standards (2024), particularly Domain II (Purpose), Domain III (Governing the Internal Audit Function) and Domain IV (Managing the Internal Audit Function), Principle 9 (Plans Strategically).

Why It Is Important
1. Value creation. Internal audit adds value only when it focuses on what matters most to the organization. A plan detached from strategy wastes scarce audit resources on low-impact areas.
2. Credibility and relevance. Boards and executives rely on internal audit for insight. If the plan ignores emerging strategic risks such as digital transformation, ESG, cybersecurity, mergers or new markets, internal audit loses credibility.
3. Effective governance. The board relies on internal audit to provide independent assurance over governance, risk management and control. Alignment ensures that assurance covers the risks to strategic objectives.
4. Standards compliance. The Standards require the CAE to:

• develop a risk-based internal audit plan,
• consider stakeholder input and the organization's strategies, objectives and risks,
• review and revise the plan as needed, and
• communicate the plan and significant changes to senior management and the board for review and approval.

5. Resource optimization. Alignment helps justify budget and staffing. It shows that resources are directed to the highest-risk, highest-priority areas.
6. Agility. Organizations face rapid change. A plan that adapts keeps internal audit forward-looking rather than reactive or historical.

What It Is
Alignment means the audit plan:

• is derived from an understanding of the organization's mission, vision, strategic objectives and business model;
• is grounded in a documented risk assessment that considers the organization's risk management framework, risk appetite and emerging risks;
• reflects input gathered from the board, audit committee, senior management, operational management, regulators and external auditors, and where relevant other assurance providers;
• is flexible and updated at least annually, and more often (continuously or rolling, for example quarterly) when significant changes occur;
• balances assurance and advisory engagements according to stakeholder needs and internal audit's mandate;
• is approved by the board and supported by senior management, with resource limitations communicated.

Key Components and Concepts
1. Understanding strategy: The CAE reviews strategic plans, business plans, budgets, board minutes and key performance indicators. This identifies what the organization is trying to achieve.

2. Risk-based planning: The CAE identifies risks to achieving those objectives. Inputs include:

• management's risk assessments and the enterprise risk management (ERM) register,
• internal audit's own independent risk assessment,
• emerging trends, industry developments, regulatory changes and fraud risks.

3. Audit universe: This is the inventory of auditable entities, processes, functions, projects and systems. It is mapped to strategic objectives and risks. It is then prioritized by risk factors such as impact, likelihood, velocity, control environment, time since last audit, changes and management concerns.

4. Stakeholder engagement: This involves formal and informal communication such as interviews, surveys, audit committee meetings and one-on-one meetings with executives. Its purpose is to understand expectations, concerns and priorities. Stakeholders' views are considered, but the CAE retains independent judgment.

5. Coordination and reliance: The CAE coordinates with other providers of assurance and advisory services (second-line functions, external auditors, regulators). This avoids duplication and gaps, often through assurance mapping. It supports combined assurance.

6. Flexibility and change management: The plan should be dynamic. Triggers for revision include:

• new strategic initiatives,
• acquisitions,
• regulatory changes,
• significant control failures or fraud,
• changes in leadership,
• economic shocks,
• technology implementations.

Significant changes must be communicated to and approved by the board.

7. Resource alignment: The plan must match available resources: people, skills, budget and technology. If resources are insufficient, the CAE must communicate the impact of the limitation to senior management and the board. Options for closing gaps include co-sourcing, outsourcing, guest auditors and training.

8. Internal audit strategy: The Standards expect the CAE to develop an internal audit strategy (vision, strategic objectives and initiatives) that supports the organization's strategy. The audit plan operationalizes this strategy.

How It Works: Step by Step
Step 1: Understand the organization. Review strategy, objectives, business model, culture, governance structure and the risk appetite set by the board.
Step 2: Gather stakeholder input. Meet with the board or audit committee chair, the CEO, the CFO, the CRO, the CIO, business unit leaders, compliance, legal and external auditors. Ask what keeps them up at night, which strategic initiatives are under way, and where they want assurance or advice.
Step 3: Perform a risk assessment. Evaluate the risks linked to each strategic objective. Use ERM outputs, but apply independent judgment. Consider fraud, IT, compliance, operational, financial, reputational and strategic risks, as well as emerging risks.
Step 4: Map and prioritize the audit universe. Score auditable units and link each to strategic objectives and key risks. Identify the coverage provided by other assurance providers.
Step 5: Draft the plan. Select engagements, both assurance and advisory. Set objectives and scope at a high level, estimate resources and define timing. Include a contingency reserve for ad hoc requests and emerging issues.
Step 6: Communicate and obtain approval. Present the plan, the resource requirements and any limitations to senior management for input and to the board for approval. Explain how the plan links to strategy and risk.
Step 7: Monitor and update. Continuously monitor the risk environment. Use rolling plans or quarterly refreshes, and adjust the plan as strategy or risks change. Communicate significant changes to the board for approval.
Step 8: Report on performance. Report plan progress, key findings and themes, and how coverage addresses strategic risks. Use performance metrics such as plan completion, stakeholder satisfaction and value added.

Common Practical Techniques

• Rolling or agile audit plans: 6-, 12- or 18-month horizons refreshed quarterly.
• Assurance mapping: showing which provider covers which risk, which reveals gaps and overlaps.
• Strategic risk heat maps: linking audit engagements to top enterprise risks.
• Stakeholder surveys and post-engagement feedback: used to calibrate relevance.
• Continuous risk assessment and data analytics: used to spot changing risk profiles in real time.
• Attendance at key management meetings: for example strategy, risk committee and project steering meetings, attended as an observer to stay informed while preserving independence.

Balancing Stakeholder Expectations with Independence
A critical exam theme is that stakeholder input is considered, but the CAE makes the final, independent judgment on the plan's content. The board, not management, approves the plan.

If management pressures the CAE to remove a high-risk area, the CAE should:

• discuss the matter with management,
• document the rationale, and
• escalate to the board if necessary.

Excluding significant risks to satisfy management would impair independence. Conversely, management requests for consulting work can be accepted when they add value, fit within the mandate and do not impair objectivity.

Typical Scenarios Tested

• A company announces a major acquisition mid-year. The CAE should reassess risk, revise the plan and communicate the change to the board.
• The audit plan was based solely on a cyclical rotation. This is deficient because it is not risk-based or aligned with strategy.
• Resources are insufficient to cover high-risk areas. The CAE should communicate the impact of the resource limitation to senior management and the board.
• Management asks internal audit to skip auditing a new ERP implementation. The CAE should evaluate the risk independently and escalate if the risk is significant.
• Senior management and the board have conflicting priorities. The CAE should facilitate discussion. The board approves the final plan.
• There are multiple assurance providers. Use coordination and assurance mapping, and rely on others' work when it is appropriate after evaluating their competence, objectivity and due professional care.

Exam Tips: Answering Questions on Keeping the Audit Plan Aligned with Strategy and Stakeholders
1. Think risk-based first. The best answer almost always ties the plan to the organization's strategies, objectives and risks. Avoid answers based solely on prior-year plans, auditor convenience, rotation cycles or equal coverage of all units.
2. Board approves, management provides input. If a question asks who approves the audit plan or significant changes, choose the board (or audit committee). Senior management reviews it and provides input.
3. Flexibility is expected. When a significant event occurs, the correct response is usually to:

• reassess risks,
• update the plan, and
• communicate the changes to the board.

Do not rigidly complete the original plan, and do not change it without communication.
4. Independence trumps pressure. If management wants to restrict scope or remove a high-risk area, the CAE should not simply comply. Look for answers involving discussion, documentation and escalation to the board.
5. Resource limitations must be communicated. The correct answer is to inform senior management and the board of the impact of the limitation. Do not just quietly reduce coverage.
6. Stakeholder input is necessary but not determinative. Choose answers where the CAE considers input from the board, management and others. Avoid answers where any single stakeholder dictates the plan.
7. Coordination reduces duplication. Answers involving coordination with external auditors, second-line functions and assurance mapping are usually preferred over answers where internal audit independently re-performs all work.
8. Watch for "most" and "best" qualifiers. Several options may be partially correct. The best answer is the most comprehensive, proactive and Standards-aligned. For example, "Understand strategic objectives and associated risks" beats "Review last year's findings."
9. Know the sources for plan development. These include strategic plans, ERM outputs, board and management input, prior audit results, regulatory requirements, emerging risks and other assurance providers' work. A question may ask which source is LEAST relevant. The answer is often something unrelated to risk, such as staff preferences.
10. Link the internal audit strategy to the organization's strategy. Questions may test that the CAE's internal audit strategy and plan support organizational objectives and the internal audit mandate and charter.
11. Recognize warning signs of misalignment. These include:

• a plan that has not changed for years,
• no coverage of major strategic initiatives,
• low stakeholder satisfaction,
• audits focused only on financial or compliance areas while strategic, IT or operational risks are ignored.

The remedy is to refresh the risk assessment and engage stakeholders.
12. Use elimination. Eliminate options that impair independence, bypass the board, ignore risk or rely solely on management's risk assessment without independent evaluation.

Quick Memory Aid: S.T.R.A.T.E.G.Y.
Strategy understood first
Talk to stakeholders
Risk assessment drives priorities
Assurance coordination and mapping
Tailor resources and communicate limitations
Escalate pressure that threatens independence
Governance approval by the board
Yearly (or more frequent) review and update

Summary
Keeping the audit plan aligned with strategy and stakeholders ensures internal audit remains relevant, risk-focused and valuable. The CAE must:

• understand the organization's objectives,
• assess risks independently,
• engage stakeholders,
• coordinate with other assurance providers,
• align resources,
• obtain board approval, and
• continuously adapt the plan as circumstances change.

In the exam, favor answers that are risk-based, strategic, flexible, independent and communicated to the board.