Developing the Risk-Based Internal Audit Plan

Why This Topic Matters
The risk-based internal audit plan is the central document that translates an organization's risk universe into a prioritized schedule of assurance and advisory work. For the CRMA (Certification in Risk Management Assurance) exam, this topic sits at the heart of the domain on Risk-Based Audit Planning and Engagements. The IIA's Global Internal Audit Standards (and the earlier Standard 2010, Planning) require the Chief Audit Executive (CAE) to establish a risk-based plan that aligns with organizational strategies, objectives, and risks. Examiners test this area heavily because it demonstrates whether a candidate understands how internal audit adds value: by focusing limited resources on the areas that matter most to the board and senior management, rather than auditing on a rotational or historical basis.

What It Is
A risk-based internal audit plan is a documented, periodic (usually annual, but increasingly dynamic or rolling) plan that identifies which auditable entities, processes, or risks will receive internal audit attention, at what depth, and with what resources. It is built on three foundations:
1. The audit universe – the complete inventory of auditable units (business units, processes, systems, projects, locations, key risks, or strategic objectives).
2. Risk assessment – an evaluation of each auditable unit's inherent and residual risk, considering likelihood and impact, control maturity, and management's own risk assessment (ERM output).
3. Prioritization and resource allocation – ranking the universe by risk and matching the available audit hours, skills, and budget to the highest-priority items, while documenting what will not be covered and why.

The plan is not a static list. The Standards require the CAE to review and adjust it in response to changes in the organization's business, risks, operations, programs, systems, and controls, and to communicate the plan, significant changes, and any resource limitations to senior management and the board for approval.

How It Works – The Step-by-Step Process
Step 1: Understand the organization. The CAE gathers knowledge of strategy, objectives, business model, regulatory environment, governance structure, and key stakeholders. Inputs include the strategic plan, board minutes, ERM reports, prior audit results, external audit findings, regulatory correspondence, and interviews with executives and audit committee members.

Step 2: Define the audit universe. Auditable units are identified at a level of granularity that allows meaningful risk assessment. Many organizations map the universe to strategic objectives or principal risks rather than only to organizational charts, which ensures emerging and cross-functional risks (cyber, third-party, culture, ESG) are captured.

Step 3: Perform the risk assessment. Each unit is scored using defined risk factors, for example: financial materiality, strategic importance, regulatory exposure, complexity, rate of change, IT dependency, fraud susceptibility, time since last audit, and results of prior audits. Scores are weighted and combined to produce an inherent risk rating; control environment assessments then yield a residual risk view. Where a mature ERM function exists, internal audit leverages management's risk register but applies independent judgment and does not simply adopt it unchallenged.

Step 4: Consider assurance from other providers. Using an assurance mapping or "three lines" approach, the CAE identifies where second-line functions (compliance, risk management, quality) or external parties already provide reliable assurance, so internal audit can rely on, coordinate with, or reduce coverage in those areas. Reliance requires evaluating the other provider's independence, objectivity, and competence.

Step 5: Prioritize and build the plan. High-risk areas receive full assurance engagements; moderate areas may receive limited-scope reviews, continuous auditing, or advisory work; low-risk areas may be deferred with a documented rationale. The plan also incorporates mandatory audits (regulatory, contractual), management and board requests, follow-up activity, advisory services, and a contingency reserve (often 10–20 percent) for emerging issues.

Step 6: Align resources. The CAE assesses whether staff numbers, competencies, and tools are adequate. Gaps are addressed through training, co-sourcing, guest auditors, or technology. Where resources are insufficient, the impact on coverage is communicated explicitly to the board.

Step 7: Obtain approval and communicate. The plan, the methodology, the risk assessment results, resource requirements, and uncovered risk areas are presented to senior management and the board (audit committee) for review and approval.

Step 8: Monitor and update. The plan is revisited at least quarterly, or continuously in agile audit environments, so that new risks (acquisitions, system implementations, regulatory change, incidents) trigger reprioritization. Changes are approved and communicated.

Key Concepts to Master
• Inherent vs. residual risk – the plan generally prioritizes on residual risk but considers inherent risk to avoid over-relying on untested controls.
• Risk appetite and tolerance – areas where residual risk exceeds appetite are natural audit priorities.
• Audit cycle vs. risk-based – a pure rotational cycle is not risk-based; however, a risk-based plan may still include minimum coverage frequencies for governance reasons.
• Independence in planning – management may request engagements, but the CAE retains authority over the plan and must not allow it to be dominated by management's preferences at the expense of high-risk areas.
• Coverage gaps – unaudited high-risk areas must be reported to the board, not silently omitted.
• Advisory vs. assurance – the plan should balance both, with advisory work accepted only when it improves risk management and does not impair objectivity.

Exam Tips: Answering Questions on Developing the Risk-Based Internal Audit Plan
1. Anchor every answer in the Standards. The correct option almost always reflects the principle that the plan must be based on a documented risk assessment, performed at least annually, with input from senior management and the board, and approved by the board. If an option describes planning based on prior-year schedules, auditor preference, or management direction alone, it is wrong.

2. Look for the word "risk" linked to "organizational objectives." Examiners favor answers that connect the plan to strategic objectives and the organization's risk appetite rather than to organizational structure or budget size.

3. Distinguish inputs from outputs. Questions may ask what the CAE should consider (inputs: ERM results, strategy, prior findings, regulatory requirements, stakeholder input) versus what the CAE must produce (outputs: prioritized plan, resource requirements, communication of limitations). Read the stem carefully.

4. Know the correct handling of management requests. The best answer is that the CAE evaluates the request against the risk assessment and includes it if justified, adjusting the plan and informing the board of significant changes. Automatically accepting or automatically refusing requests are both distractors.

5. Resource shortfalls go to the board. When a scenario describes insufficient staff or skills, the correct response is to communicate the impact on coverage to senior management and the board, not to quietly reduce scope or extend the audit cycle without disclosure.

6. Reliance on other assurance providers requires assessment. If a question asks whether internal audit can rely on compliance or risk management work, the answer hinges on evaluating that provider's competence, objectivity, and due care, and on the CAE retaining responsibility for conclusions.

7. Dynamic updating is expected. Scenarios describing a mid-year acquisition, a major cyber incident, or a new regulation test whether you know the plan should be reassessed and revised, with changes communicated and approved, rather than deferred to next year.

8. Residual risk drives priority, but be careful. If controls have never been tested, inherent risk may be the better basis. Choose answers that reflect professional skepticism about untested control assertions.

9. Eliminate absolutes and extremes. Options containing "always," "never," "all auditable units every year," or "only high-risk areas" are usually distractors. Risk-based planning involves judgment, proportionality, and documented rationale.

10. Think like the CAE, not the staff auditor. CRMA questions on planning are written at the level of the head of internal audit. The best answer protects independence, serves the board's need for assurance on key risks, and documents the basis for decisions.

Sample Question Walkthrough
The CAE of a manufacturing company is developing the annual audit plan. The ERM function has provided a risk register rating supply chain disruption as high. The CFO asks that the plan focus primarily on financial close processes, which were rated low risk. What should the CAE do?
Reasoning: The plan must be risk-based and aligned to organizational objectives. The CAE should give priority to supply chain risk, consider the CFO's request on its merits, possibly include a limited-scope or advisory engagement on financial close if justified, and present the rationale to the audit committee for approval. The answer that has the CAE comply fully with the CFO at the expense of the high-risk area, or ignore the CFO entirely without evaluation, would be incorrect.

Summary
Developing the risk-based internal audit plan is about disciplined prioritization: define the universe, assess risk against objectives, leverage but challenge ERM, coordinate with other assurance providers, allocate resources transparently, secure board approval, and keep the plan alive as risks evolve. On the exam, choose the answer that is risk-driven, Standards-aligned, independent, documented, and communicated to the board.