Management Requests in the Audit Plan
5 minutes
5 Questions
In the context of the Certification in Risk Management Assurance (CRMA) and risk-based audit planning, 'Management Requests' refer to engagements that senior management (or occasionally the board) asks internal audit to perform, outside of or in addition to the engagements identified through the internal audit function's own risk assessment. These requests often arise from emerging concerns, such as suspected control weaknesses, operational problems, new systems or processes, regulatory inquiries, or a desire for independent assurance or advisory input on a specific area. The IIA Standards (Standard 2010 – Planning, and the 2024 Global Internal Audit Standards, Standard 9.4 – Internal Audit Plan) require the Chief Audit Executive (CAE) to establish a risk-based plan, and explicitly state that the CAE must consider input from senior management and the board when developing it. Management requests are therefore a legitimate and valuable input, because management often has first-hand knowledge of operational risks that may not yet be visible in formal risk registers. However, management requests must be handled carefully to preserve independence and objectivity. The CAE should evaluate each request against the organization's risk profile, asking whether the request addresses a genuine risk, whether it aligns with the audit function's purpose, and whether accepting it would displace higher-risk engagements. Requests that would turn internal audit into an extension of management (e.g., performing operational duties or designing controls) should be declined or structured as advisory engagements with clear safeguards. Good practice includes: documenting the rationale for accepting or rejecting requests; building a contingency allowance (often 10–20% of available hours) into the annual plan to accommodate unplanned requests; communicating to the audit committee any significant changes to the plan resulting from management requests; and confirming that the board retains ultimate approval of the plan. This ensures responsiveness to management while keeping the plan anchored in risk, consistent with CRMA principles of providing risk-based, independent assurance over governance, risk management, and control processes.
Management Requests in the Audit Plan: A Complete CRMA Study Guide
1. Why This Topic Matters
Internal audit exists to provide independent, risk-based assurance and advice. Yet the internal audit function does not operate in a vacuum: senior management and operating managers constantly ask the chief audit executive (CAE) for help. They may want a review of a troubled project, a look at a new system, an investigation of suspected fraud, advice on a control design, or simply 'an audit of Department X because something feels wrong.' How the CAE handles these requests is one of the clearest tests of whether the audit function is truly risk-based and truly independent.
For the CRMA exam, this topic sits inside the domain on risk-based audit planning. It tests whether you understand that:
- The audit plan must be driven by a documented risk assessment, not by whoever shouts loudest.
- Input from management and the board is required, but management does not dictate the plan.
- Consulting (advisory) requests must be weighed for their potential to improve governance, risk management and control.
- Accepting a request may consume scarce resources and can threaten objectivity if the CAE or staff assume management responsibilities.
- Significant changes to the plan must be communicated to, and approved by, the board (audit committee).
Examiners love this area because it forces you to balance competing goods: responsiveness versus independence, flexibility versus discipline, adding value versus protecting the integrity of the risk-based plan.
2. What 'Management Requests' Are
A management request is any ask from senior management, operating management, or occasionally the board, for the internal audit function to perform work that was not originally scheduled in the approved audit plan, or to re-prioritize scheduled work. Typical forms include:
Assurance requests - 'Please audit the new procurement process.' These are objective examinations of evidence to provide an opinion on governance, risk management or control.
Consulting or advisory requests - 'Help us design controls for the ERP implementation' or 'Facilitate a risk workshop for the new product line.' The nature and scope are agreed with the client, and the aim is to add value and improve operations without the auditor taking on management decision rights.
Special investigations - 'Someone reported possible expense fraud in Sales.' Usually urgent and unplanned.
Operational or non-audit tasks - 'Can your team run the inventory count?' or 'Can you approve these vendor payments while the controller is on leave?' These are the dangerous ones because they are management responsibilities, not audit work.
Reprioritization requests - 'Postpone the treasury audit; we need you on the merger due diligence.'
The Standards explicitly recognize this reality. Under the International Professional Practices Framework (Standard 2010), the CAE must establish a risk-based plan and must consider input from senior management and the board. Standard 2010.C1 states that the CAE should consider accepting proposed consulting engagements based on their potential to improve the management of risks, add value and improve operations, and that accepted engagements must be included in the plan. The Global Internal Audit Standards (2024) carry the same ideas forward in Standard 9.4 (Internal Audit Plan), which requires the CAE to obtain input from the board and senior management, keep the plan dynamic, and communicate significant changes for board approval, and in Standard 9.5 (Coordination and Reliance). Independence provisions (Standard 1100 series / Domain III of the 2024 Standards) remind us that assuming operational responsibilities impairs independence and objectivity.
3. How It Works: The CAE's Decision Process
Think of the approved audit plan as the baseline and every management request as a proposed amendment that must earn its place. A disciplined CAE walks through a repeatable process:
Step 1 - Capture and clarify the request. What exactly is being asked? Is it assurance, consulting, investigation, or an operational task in disguise? Who is the sponsor? What is the business driver? What is the deadline?
Step 2 - Classify the request. Determine whether it is an assurance engagement (internal audit determines scope and reports to the board) or a consulting engagement (scope agreed with the client, advisory in nature). Classification drives the applicable standards, the reporting lines, and the independence safeguards.
Step 3 - Evaluate against the risk assessment. The core question: Does this request address a risk that is significant to the organization's objectives? Compare the request with the enterprise risk assessment that underpins the plan. Consider inherent and residual risk, recent changes (new systems, reorganizations, regulatory changes, control failures), results of prior audits, and the risk appetite of the organization. A request that targets a high-risk, high-impact area should rank highly; a request to re-audit a low-risk area that was reviewed last year generally should not.
Step 4 - Assess value added and alignment with strategy. Will the engagement improve governance, risk management or control? Does it support strategic objectives? Could another function (compliance, quality, external consultant) perform it more appropriately? Internal audit should not be the 'free consulting department' for routine operational chores.
Step 5 - Test independence and objectivity. Ask: Would performing this work put internal audit in a management role (making decisions, designing and then owning controls, approving transactions)? Would an auditor later audit his or her own work? If the answer is yes, decline, restructure the engagement, or put safeguards in place (different staff, disclosure, limiting scope to advice rather than decisions). Remember the rule of thumb: internal audit can advise on control design but should not implement or operate controls.
Step 6 - Consider resources and competencies. Does the function have the hours, skills and tools? Many CAEs build a contingency reserve (often 10 to 20 percent of available hours) into the annual plan specifically for management requests and emerging risks. If the reserve is exhausted, accepting a request means deferring or dropping something else, and that trade-off must be explicit.
Step 7 - Decide: accept, modify, defer or decline. Document the rationale. If accepting, define objectives and scope, and for consulting work agree these with the client in writing. If declining, explain why in terms of risk, value and independence, and where possible suggest alternatives.
Step 8 - Update the plan and communicate. Minor adjustments within the CAE's delegated authority can simply be documented and reported periodically. Significant changes (dropping a high-risk audit, major resource shifts, accepting a large consulting project) must be communicated to senior management and the board for review and approval. This is the mechanism that protects the plan from being quietly hijacked.
Step 9 - Report results appropriately. Assurance results are reported in the normal manner, including to the board. Consulting results are generally reported to the client, but significant governance, risk or control issues identified during consulting work must be escalated to senior management and the board.
4. Key Principles to Internalize
- Input, not instruction. Management and the board provide input to the plan; the CAE owns the plan; the board approves it. Management cannot unilaterally add, remove or veto engagements.
- Risk-based means evidence-based. Every addition or deletion should be traceable to a risk rationale, not to personalities or politics.
- Flexibility is a feature, not a flaw. A rigid plan that ignores emerging risks and legitimate requests is as unprofessional as a plan that bends to every wish. The Standards call for a dynamic plan that is reviewed and adjusted as needed.
- Independence is non-negotiable. Assuming operational responsibility, making management decisions, or auditing areas where the auditor recently held responsibility impairs objectivity and must be avoided or disclosed.
- Consulting is permitted and valuable - but only when it has the potential to improve risk management and operations, and only with clear agreement on scope and roles.
- Transparency with the board. Significant interim changes, resource constraints and the impact of accepted requests on planned coverage must be reported to the board.
5. Common Pitfalls (and Exam Distractors)
- Automatically accepting all management requests because 'the customer is always right.' This abandons the risk-based approach.
- Automatically refusing all requests because 'they are not in the approved plan.' This ignores Standard 2010's requirement to consider management input and the need for a dynamic plan.
- Accepting an operational task (running the count, approving payments, managing a project) that constitutes a management responsibility.
- Dropping a high-risk audit to make room for a request without informing the board.
- Treating a fraud allegation like a routine consulting request instead of following the investigation protocol and escalating promptly.
- Allowing scope creep: a small consulting request gradually becomes de facto ownership of a control process.
- Failing to document the evaluation and the decision, so there is no audit trail of why the plan changed.
6. Exam Tips: Answering Questions on Management Requests in the Audit Plan
Tip 1 - Look for the 'evaluate, then decide' answer. The correct option almost always has the CAE assessing the request against the risk assessment, value added, resources and independence before deciding. Options that have the CAE accept immediately or refuse outright are usually wrong.
Tip 2 - Beware absolute words. 'Always,' 'never,' 'immediately,' 'must refuse,' and 'all requests' are red flags. Professional judgment, not blanket rules, governs this area.
Tip 3 - When the plan changes significantly, the board must know. If a question involves postponing or cancelling a planned high-risk engagement to accommodate a request, the best answer includes communicating the change and its impact to senior management and the board (audit committee) for approval.
Tip 4 - Separate advice from ownership. If an option has internal audit designing, implementing, operating or approving something, think 'independence impairment.' If the option has internal audit advising, facilitating, evaluating or recommending, that is generally acceptable consulting.
Tip 5 - Classify the engagement type. Questions often hinge on whether the request is assurance or consulting. Consulting: scope agreed with client, reported to client, included in plan if accepted under 2010.C1 criteria. Assurance: internal audit sets scope, reports to the board. Choose the answer consistent with the classification.
Tip 6 - Remember the contingency reserve. If asked how a CAE should prepare for unplanned requests, the answer involves building unallocated time into the annual plan and having a documented process for prioritizing emerging work.
Tip 7 - Fraud and urgent matters get escalated, not scheduled. A credible fraud allegation is not simply 'added to next quarter's plan'; the CAE follows the investigation protocol, considers who should lead it, and informs the appropriate level of management and the board as required.
Tip 8 - 'Best' versus 'acceptable.' When several options seem defensible, prefer the one that preserves the risk-based nature of the plan, maintains independence, and keeps the board informed. That combination is nearly always the examiner's intended answer.
Tip 9 - Apply the hierarchy. The CAE has authority to make reasonable adjustments; the board approves the plan and significant changes; management provides input and requests. Answers that invert this hierarchy (for example, 'the CFO approves the revised plan') are wrong.
Tip 10 - Think about resource trade-offs explicitly. If the function is at capacity, the correct answer acknowledges that accepting a request means something else is deferred, and that this trade-off should be evaluated on risk and communicated.
7. Worked Example
Scenario: Two months into the year, the chief operating officer asks the CAE to perform a comprehensive review of a new warehouse management system that is scheduled to go live next quarter. The approved plan already allocates all audit hours, including a low-risk review of the facilities maintenance function scheduled for the same period. What should the CAE do first?
A. Decline because the review is not in the approved plan.
B. Accept immediately because the request comes from a senior executive.
C. Evaluate the system implementation against the organization's risk assessment, assess the impact on independence and resources, and if the risk warrants it, propose a plan change to the audit committee that defers the low-risk facilities review.
D. Assign audit staff to configure the system controls so the go-live is successful.
Analysis: A is a rigid refusal that ignores the requirement to consider management input and emerging risk. B abandons risk-based judgment. D makes internal audit the owner of controls - a clear independence impairment. C follows the evaluate-then-decide model, uses risk to drive the trade-off, and routes the significant plan change to the board. C is correct.
8. Quick Revision Summary
- Management requests are expected and the Standards require the CAE to consider them.
- The audit plan stays risk-based; requests are evaluated against risk, value, resources and independence.
- Consulting requests are accepted when they can improve risk management, add value and improve operations - and are then added to the plan.
- Internal audit advises; it does not assume management responsibilities.
- Significant plan changes are communicated to and approved by the board.
- Document every decision and its rationale.
- On the exam: avoid absolutes, pick 'evaluate first,' protect independence, and keep the board informed.
Internal audit exists to provide independent, risk-based assurance and advice. Yet the internal audit function does not operate in a vacuum: senior management and operating managers constantly ask the chief audit executive (CAE) for help. They may want a review of a troubled project, a look at a new system, an investigation of suspected fraud, advice on a control design, or simply 'an audit of Department X because something feels wrong.' How the CAE handles these requests is one of the clearest tests of whether the audit function is truly risk-based and truly independent.
For the CRMA exam, this topic sits inside the domain on risk-based audit planning. It tests whether you understand that:
- The audit plan must be driven by a documented risk assessment, not by whoever shouts loudest.
- Input from management and the board is required, but management does not dictate the plan.
- Consulting (advisory) requests must be weighed for their potential to improve governance, risk management and control.
- Accepting a request may consume scarce resources and can threaten objectivity if the CAE or staff assume management responsibilities.
- Significant changes to the plan must be communicated to, and approved by, the board (audit committee).
Examiners love this area because it forces you to balance competing goods: responsiveness versus independence, flexibility versus discipline, adding value versus protecting the integrity of the risk-based plan.
2. What 'Management Requests' Are
A management request is any ask from senior management, operating management, or occasionally the board, for the internal audit function to perform work that was not originally scheduled in the approved audit plan, or to re-prioritize scheduled work. Typical forms include:
Assurance requests - 'Please audit the new procurement process.' These are objective examinations of evidence to provide an opinion on governance, risk management or control.
Consulting or advisory requests - 'Help us design controls for the ERP implementation' or 'Facilitate a risk workshop for the new product line.' The nature and scope are agreed with the client, and the aim is to add value and improve operations without the auditor taking on management decision rights.
Special investigations - 'Someone reported possible expense fraud in Sales.' Usually urgent and unplanned.
Operational or non-audit tasks - 'Can your team run the inventory count?' or 'Can you approve these vendor payments while the controller is on leave?' These are the dangerous ones because they are management responsibilities, not audit work.
Reprioritization requests - 'Postpone the treasury audit; we need you on the merger due diligence.'
The Standards explicitly recognize this reality. Under the International Professional Practices Framework (Standard 2010), the CAE must establish a risk-based plan and must consider input from senior management and the board. Standard 2010.C1 states that the CAE should consider accepting proposed consulting engagements based on their potential to improve the management of risks, add value and improve operations, and that accepted engagements must be included in the plan. The Global Internal Audit Standards (2024) carry the same ideas forward in Standard 9.4 (Internal Audit Plan), which requires the CAE to obtain input from the board and senior management, keep the plan dynamic, and communicate significant changes for board approval, and in Standard 9.5 (Coordination and Reliance). Independence provisions (Standard 1100 series / Domain III of the 2024 Standards) remind us that assuming operational responsibilities impairs independence and objectivity.
3. How It Works: The CAE's Decision Process
Think of the approved audit plan as the baseline and every management request as a proposed amendment that must earn its place. A disciplined CAE walks through a repeatable process:
Step 1 - Capture and clarify the request. What exactly is being asked? Is it assurance, consulting, investigation, or an operational task in disguise? Who is the sponsor? What is the business driver? What is the deadline?
Step 2 - Classify the request. Determine whether it is an assurance engagement (internal audit determines scope and reports to the board) or a consulting engagement (scope agreed with the client, advisory in nature). Classification drives the applicable standards, the reporting lines, and the independence safeguards.
Step 3 - Evaluate against the risk assessment. The core question: Does this request address a risk that is significant to the organization's objectives? Compare the request with the enterprise risk assessment that underpins the plan. Consider inherent and residual risk, recent changes (new systems, reorganizations, regulatory changes, control failures), results of prior audits, and the risk appetite of the organization. A request that targets a high-risk, high-impact area should rank highly; a request to re-audit a low-risk area that was reviewed last year generally should not.
Step 4 - Assess value added and alignment with strategy. Will the engagement improve governance, risk management or control? Does it support strategic objectives? Could another function (compliance, quality, external consultant) perform it more appropriately? Internal audit should not be the 'free consulting department' for routine operational chores.
Step 5 - Test independence and objectivity. Ask: Would performing this work put internal audit in a management role (making decisions, designing and then owning controls, approving transactions)? Would an auditor later audit his or her own work? If the answer is yes, decline, restructure the engagement, or put safeguards in place (different staff, disclosure, limiting scope to advice rather than decisions). Remember the rule of thumb: internal audit can advise on control design but should not implement or operate controls.
Step 6 - Consider resources and competencies. Does the function have the hours, skills and tools? Many CAEs build a contingency reserve (often 10 to 20 percent of available hours) into the annual plan specifically for management requests and emerging risks. If the reserve is exhausted, accepting a request means deferring or dropping something else, and that trade-off must be explicit.
Step 7 - Decide: accept, modify, defer or decline. Document the rationale. If accepting, define objectives and scope, and for consulting work agree these with the client in writing. If declining, explain why in terms of risk, value and independence, and where possible suggest alternatives.
Step 8 - Update the plan and communicate. Minor adjustments within the CAE's delegated authority can simply be documented and reported periodically. Significant changes (dropping a high-risk audit, major resource shifts, accepting a large consulting project) must be communicated to senior management and the board for review and approval. This is the mechanism that protects the plan from being quietly hijacked.
Step 9 - Report results appropriately. Assurance results are reported in the normal manner, including to the board. Consulting results are generally reported to the client, but significant governance, risk or control issues identified during consulting work must be escalated to senior management and the board.
4. Key Principles to Internalize
- Input, not instruction. Management and the board provide input to the plan; the CAE owns the plan; the board approves it. Management cannot unilaterally add, remove or veto engagements.
- Risk-based means evidence-based. Every addition or deletion should be traceable to a risk rationale, not to personalities or politics.
- Flexibility is a feature, not a flaw. A rigid plan that ignores emerging risks and legitimate requests is as unprofessional as a plan that bends to every wish. The Standards call for a dynamic plan that is reviewed and adjusted as needed.
- Independence is non-negotiable. Assuming operational responsibility, making management decisions, or auditing areas where the auditor recently held responsibility impairs objectivity and must be avoided or disclosed.
- Consulting is permitted and valuable - but only when it has the potential to improve risk management and operations, and only with clear agreement on scope and roles.
- Transparency with the board. Significant interim changes, resource constraints and the impact of accepted requests on planned coverage must be reported to the board.
5. Common Pitfalls (and Exam Distractors)
- Automatically accepting all management requests because 'the customer is always right.' This abandons the risk-based approach.
- Automatically refusing all requests because 'they are not in the approved plan.' This ignores Standard 2010's requirement to consider management input and the need for a dynamic plan.
- Accepting an operational task (running the count, approving payments, managing a project) that constitutes a management responsibility.
- Dropping a high-risk audit to make room for a request without informing the board.
- Treating a fraud allegation like a routine consulting request instead of following the investigation protocol and escalating promptly.
- Allowing scope creep: a small consulting request gradually becomes de facto ownership of a control process.
- Failing to document the evaluation and the decision, so there is no audit trail of why the plan changed.
6. Exam Tips: Answering Questions on Management Requests in the Audit Plan
Tip 1 - Look for the 'evaluate, then decide' answer. The correct option almost always has the CAE assessing the request against the risk assessment, value added, resources and independence before deciding. Options that have the CAE accept immediately or refuse outright are usually wrong.
Tip 2 - Beware absolute words. 'Always,' 'never,' 'immediately,' 'must refuse,' and 'all requests' are red flags. Professional judgment, not blanket rules, governs this area.
Tip 3 - When the plan changes significantly, the board must know. If a question involves postponing or cancelling a planned high-risk engagement to accommodate a request, the best answer includes communicating the change and its impact to senior management and the board (audit committee) for approval.
Tip 4 - Separate advice from ownership. If an option has internal audit designing, implementing, operating or approving something, think 'independence impairment.' If the option has internal audit advising, facilitating, evaluating or recommending, that is generally acceptable consulting.
Tip 5 - Classify the engagement type. Questions often hinge on whether the request is assurance or consulting. Consulting: scope agreed with client, reported to client, included in plan if accepted under 2010.C1 criteria. Assurance: internal audit sets scope, reports to the board. Choose the answer consistent with the classification.
Tip 6 - Remember the contingency reserve. If asked how a CAE should prepare for unplanned requests, the answer involves building unallocated time into the annual plan and having a documented process for prioritizing emerging work.
Tip 7 - Fraud and urgent matters get escalated, not scheduled. A credible fraud allegation is not simply 'added to next quarter's plan'; the CAE follows the investigation protocol, considers who should lead it, and informs the appropriate level of management and the board as required.
Tip 8 - 'Best' versus 'acceptable.' When several options seem defensible, prefer the one that preserves the risk-based nature of the plan, maintains independence, and keeps the board informed. That combination is nearly always the examiner's intended answer.
Tip 9 - Apply the hierarchy. The CAE has authority to make reasonable adjustments; the board approves the plan and significant changes; management provides input and requests. Answers that invert this hierarchy (for example, 'the CFO approves the revised plan') are wrong.
Tip 10 - Think about resource trade-offs explicitly. If the function is at capacity, the correct answer acknowledges that accepting a request means something else is deferred, and that this trade-off should be evaluated on risk and communicated.
7. Worked Example
Scenario: Two months into the year, the chief operating officer asks the CAE to perform a comprehensive review of a new warehouse management system that is scheduled to go live next quarter. The approved plan already allocates all audit hours, including a low-risk review of the facilities maintenance function scheduled for the same period. What should the CAE do first?
A. Decline because the review is not in the approved plan.
B. Accept immediately because the request comes from a senior executive.
C. Evaluate the system implementation against the organization's risk assessment, assess the impact on independence and resources, and if the risk warrants it, propose a plan change to the audit committee that defers the low-risk facilities review.
D. Assign audit staff to configure the system controls so the go-live is successful.
Analysis: A is a rigid refusal that ignores the requirement to consider management input and emerging risk. B abandons risk-based judgment. D makes internal audit the owner of controls - a clear independence impairment. C follows the evaluate-then-decide model, uses risk to drive the trade-off, and routes the significant plan change to the board. C is correct.
8. Quick Revision Summary
- Management requests are expected and the Standards require the CAE to consider them.
- The audit plan stays risk-based; requests are evaluated against risk, value, resources and independence.
- Consulting requests are accepted when they can improve risk management, add value and improve operations - and are then added to the plan.
- Internal audit advises; it does not assume management responsibilities.
- Significant plan changes are communicated to and approved by the board.
- Document every decision and its rationale.
- On the exam: avoid absolutes, pick 'evaluate first,' protect independence, and keep the board informed.
Test mode:
CRMA - Management Requests in the Audit Plan Example Questions
Test your knowledge of Management Requests in the Audit Plan
Question 1
Midyear, the head of procurement asks the internal audit function to review vendor onboarding after a near-miss payment fraud. The chief audit executive agrees. To fit the review in, the chief audit executive defers a scheduled engagement covering a higher-rated cybersecurity risk. The decision relies on the manager's own urgency rating, and the chief audit executive plans to inform the audit committee at year-end. Which evaluation of the chief audit executive's approach is MOST accurate?
Question 2
During annual planning, the chief operating officer asks the internal audit function to include a project to design and operate the key supply chain controls of a newly acquired subsidiary until a local team is hired. The officer cites internal audit's control expertise. The organizationwide risk assessment rates the subsidiary as high risk. How should the chief audit executive BEST address this request in the risk-based internal audit plan?
Question 3
During annual planning, the chief financial officer asks the internal audit function to review a recently outsourced payroll process. The chief audit executive's organizationwide risk assessment rated payroll as moderate risk. Several higher-rated areas already use most of the available audit hours. Which action is MOST appropriate for the chief audit executive?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2615 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Management Requests in the Audit Plan questions
19 questions (total)
Other Risk-Based Audit Planning and Engagements concepts
Aggregating Results Across EngagementsAudit Plan Approval and Resource CommunicationDeveloping Staff Through EngagementsDeveloping the Risk-Based Internal Audit PlanEngagement Objectives and Scope for Risk EngagementsEngagement SupervisionEngagement Work ProgramsEvaluating Management's Risk RemediationForming an Overall Assessment of Risk ManagementManaging Engagement Resources and TimelinesMarket and Industry Trends as Sources of RiskOrganizationwide Risk Assessment for Audit PlanningPrioritizing Engagements by RiskQuality Assurance in EngagementsRegulatory Change as a Source of RiskThe Audit UniverseUpdating the Audit Plan for Changing RisksUsing Management's Risk Assessment in PlanningUsing Other Providers' Work in an Overall Assessment