Updating the Audit Plan for Changing Risks

Why This Topic Matters

The Certification in Risk Management Assurance (CRMA) exam places heavy emphasis on the idea that internal audit must be dynamic, not static. Organizations operate in environments where risks shift continuously: new regulations appear, technology changes, mergers happen, key personnel leave, fraud is discovered, markets collapse, and pandemics strike. An audit plan that was perfectly reasonable in January may be dangerously irrelevant by June.

The IIA's Global Internal Audit Standards (and the previous International Standards for the Professional Practice of Internal Auditing) explicitly require the Chief Audit Executive (CAE) to establish a risk-based plan and to review and adjust it as necessary in response to changes in the organization's business, risks, operations, programs, systems, and controls. If you understand this concept well, you will be able to answer a large family of exam questions that test judgment about when, why, and how the audit plan should change.

This topic is important for three practical reasons:
1. Relevance of assurance - Stakeholders rely on internal audit to tell them about the risks that matter now. Auditing yesterday's risks provides false comfort.
2. Efficient use of scarce resources - Audit hours are limited. Spending them on low-risk areas while emerging high risks go unexamined is a misallocation.
3. Governance credibility - Boards and audit committees expect the CAE to demonstrate that the plan reflects the current risk landscape. A CAE who cannot explain how the plan responds to change loses credibility.

What It Is

Updating the audit plan for changing risks is the ongoing process by which the internal audit function monitors the internal and external environment, identifies changes in the organization's risk profile, evaluates the impact of those changes on the existing audit plan, and makes approved modifications to engagement priorities, scope, timing, and resource allocation.

Key components of the concept include:

1. The Risk-Based Audit Plan as a Baseline
The plan is initially built from a risk assessment that considers the organization's strategies, objectives, risk appetite, the enterprise risk management (ERM) framework, management's own risk assessments, and input from the board and senior management. The audit universe (all auditable entities) is prioritized by risk, and engagements are scheduled accordingly.

2. Continuous or Periodic Risk Assessment
The Standards require that the risk assessment be performed at least annually, but leading practice is continuous or rolling assessment, often quarterly or more frequently. The CAE should not wait for the annual cycle if a significant change occurs mid-year.

3. Triggers for Change
Events or conditions that should prompt a review of the plan include:
- Major organizational changes: mergers, acquisitions, divestitures, restructuring, new business lines, entering new geographies
- New or changed laws and regulations
- Significant changes in strategy or objectives
- New systems implementations or major technology changes (ERP conversions, cloud migration, AI adoption)
- Changes in key management or governance personnel
- Discovery of fraud, significant control failures, or major audit findings
- Economic shocks, market volatility, supply chain disruptions, cyber incidents
- Changes in the organization's risk appetite or tolerance
- Requests from the board, audit committee, or senior management
- Changes in internal audit's own resources (loss of staff, budget cuts, new skills acquired)
- Results of other assurance providers (external audit, regulators, compliance) that reveal new risk information

4. Types of Plan Adjustments
- Adding new engagements to address emerging risks
- Removing or deferring engagements whose underlying risk has declined
- Changing scope of a planned engagement to focus on the changed risk area
- Re-sequencing engagements so higher-risk areas are audited sooner
- Reallocating resources (staff, budget, co-sourcing, guest auditors) to match new priorities
- Changing the nature of an engagement, e.g., from assurance to advisory, or from a full audit to a limited review

5. Governance of Changes
Significant changes to the audit plan must be communicated to and approved by the board (typically the audit committee) and senior management. The CAE retains responsibility for the plan, but the board approves it and must be informed of interim changes. The CAE should also communicate the impact of resource limitations on the plan's coverage and any resulting risk the organization is accepting by not auditing certain areas.

6. Documentation
Changes should be documented, including the rationale, the risk analysis supporting the change, who approved it, and the effect on overall coverage. This supports transparency, quality assurance reviews, and the CAE's ability to defend the plan.

How It Works in Practice

Step 1: Establish Monitoring Mechanisms
The internal audit function builds channels to detect change early. These include regular meetings with senior management and risk owners, attendance at risk committee and board meetings, review of ERM reports and key risk indicators (KRIs), monitoring of regulatory developments, review of incident logs, whistleblower hotline trends, and industry intelligence. Many functions designate a staff member or team to own "emerging risk" monitoring.

Step 2: Assess the Change
When a trigger is identified, the CAE or audit management evaluates: What is the new or changed risk? How significant is it in terms of likelihood and impact relative to organizational objectives? Does management have adequate controls or responses in place? Is the risk already covered by a planned engagement, or is there a gap? Could another assurance provider address it instead (reliance and coordination)?

Step 3: Determine the Required Plan Response
Based on the assessment, decide whether to add, defer, re-scope, re-sequence, or leave the plan unchanged. Consider the opportunity cost: if a new engagement is added, which existing engagement will be deferred or reduced, and what residual risk does that create? Use the same risk-ranking methodology applied in the original plan so that decisions are consistent and defensible.

Step 4: Consider Resource Implications
Evaluate whether current staff have the competencies needed for the new engagement (e.g., cybersecurity, ESG, data analytics). If not, consider training, co-sourcing, outsourcing, or using subject matter experts. Confirm whether budget adjustments are required.

Step 5: Obtain Approval
Present significant changes to senior management and the audit committee with a clear explanation of the risk rationale, the trade-offs, and the impact on coverage. Minor changes may be handled under delegated authority defined in the internal audit charter, but the CAE must still report them periodically.

Step 6: Communicate and Execute
Inform affected auditees and the audit team, update the audit management system and schedules, and begin the revised work. Ensure engagement-level planning (objectives, scope, risk assessment, work programs) is also updated to reflect the changed risk, not just the macro plan.

Step 7: Report and Reassess
Report to the board on plan status, changes made, and emerging risks on a regular basis (often quarterly). Continue the cycle. The plan is a living document.

Relationship to Engagement-Level Planning

Changing risks affect not only the annual plan but also individual engagements. During an engagement, auditors may discover that the risk profile is different from what the preliminary survey assumed. In that case the engagement objectives, scope, and work program should be revised, and significant scope changes should be communicated to management and, where appropriate, the board. This is a common exam angle: the question may describe a mid-engagement discovery and ask what the auditor in charge should do.

Common Pitfalls

- Treating the annual plan as fixed and only revisiting it at year-end
- Changing the plan informally without documenting rationale or obtaining approval
- Allowing management to redirect audit resources away from sensitive areas under the guise of "changing priorities" (an independence concern)
- Adding engagements without removing any, leading to an unrealistic plan and burnout
- Failing to communicate to the board the residual risk created by deferred engagements
- Reacting only to crises rather than proactively scanning for emerging risks
- Ignoring changes in internal audit's own capacity as a reason to revisit the plan

How to Answer Exam Questions on This Topic

CRMA questions in this area are usually scenario-based and test professional judgment. They typically describe an event (acquisition, new regulation, fraud discovery, system implementation, budget cut) and ask what the CAE or auditor should do first, most appropriately, or best. Keep these principles in mind:

1. Risk drives the plan. Whenever a scenario involves a material change in risk, the correct answer almost always involves reassessing the risk and adjusting the plan accordingly rather than continuing the original plan unchanged.

2. Assess before acting. If the options include "immediately add an audit" versus "evaluate the impact of the change on the risk assessment and plan," the evaluation step generally comes first. The IIA favors a disciplined, documented assessment over impulsive reaction.

3. The board approves significant changes. If a scenario asks who must approve a major plan revision, the answer is the board/audit committee (with senior management informed or consulted). The CAE proposes; the board approves. The CAE does not unilaterally make significant changes without reporting them.

4. Trade-offs must be communicated. If resources are limited and something must be deferred, the correct answer includes informing the board of the coverage gap and the risk being accepted. Silently dropping an engagement is wrong.

5. Independence is preserved. Be alert to scenarios where management asks to postpone or cancel an audit of a sensitive area. The CAE should evaluate the request on risk grounds and, if the area remains high risk, maintain the engagement and escalate to the board if necessary. Management convenience is not a valid reason to remove a high-risk audit.

6. Engagement-level changes follow the same logic. If a scenario is mid-engagement, the answer usually involves revising engagement objectives/scope, documenting the change, and communicating it to appropriate stakeholders.

7. Use the same methodology. Answers that apply the original risk-ranking criteria consistently are preferred over ad hoc decisions.

Exam Tips: Answering Questions on Updating the Audit Plan for Changing Risks

Tip 1: Look for the keyword "first" or "most appropriate." When asked what the CAE should do first after a significant change, the answer is typically to reassess the risk and its impact on the plan, not to immediately start fieldwork or immediately inform the external auditor.

Tip 2: Eliminate answers that keep the plan static. Any option suggesting the CAE should "complete the approved plan as scheduled and consider the new risk next year" is almost always a distractor when the scenario describes a significant risk change.

Tip 3: Eliminate answers where the CAE acts alone on major changes. Options in which the CAE revises the plan significantly without informing or obtaining approval from the board are incorrect. Conversely, options requiring board approval for every trivial change are also unrealistic; the charter typically delegates minor adjustments to the CAE.

Tip 4: Watch for resource-reduction scenarios. If the audit budget or staff is cut, the best answer involves re-prioritizing based on risk, communicating the impact on coverage to the board, and letting the board decide on the acceptability of reduced assurance. The CAE should not simply do less without telling anyone.

Tip 5: Recognize the distinction between annual and continuous assessment. "At least annually" is the minimum frequency for the risk assessment. If an answer states the plan should only be updated annually, it is wrong. If an answer refers to continuous or periodic updating in response to change, it aligns with the Standards.

Tip 6: Connect to ERM and other assurance providers. A strong answer often involves leveraging management's updated risk assessments, ERM output, and coordination with other assurance functions to avoid duplication when responding to new risks.

Tip 7: Remember documentation. If asked how the CAE should support a plan change, the answer includes documenting the risk rationale and approval. This is frequently tested in questions about quality assurance and improvement programs.

Tip 8: Beware of management pressure distractors. If senior management wants an audit removed because "the area is under a lot of pressure right now," that is a red flag, not a legitimate reason. The correct response is to evaluate risk, maintain independence, and escalate if needed.

Tip 9: Apply the "risk-based" lens to every option. Ask yourself: does this answer allocate audit effort to where the risk is now greatest? If yes, it is likely correct. If it allocates effort based on history, convenience, or rotation alone, it is likely a distractor.

Tip 10: Think like a CAE presenting to the audit committee. The best answer is the one you could comfortably defend to an audit committee as being thoughtful, risk-driven, transparent, and compliant with the Standards.

Sample Question Walkthrough

Scenario: Midway through the year, the organization announces the acquisition of a competitor with operations in a country known for corruption risk. The approved audit plan does not include any work related to the acquisition. Which of the following is the most appropriate action for the CAE?

A. Complete the approved plan and include the acquisition in next year's risk assessment.
B. Immediately reassign the entire audit team to the acquisition.
C. Assess the risks arising from the acquisition, determine the impact on the audit plan, propose necessary changes, and obtain audit committee approval for significant revisions.
D. Ask the external auditors to cover the acquisition since it will affect the financial statements.

Analysis: Option A ignores a significant risk change and is wrong. Option B is an impulsive reaction without assessment or approval. Option D abdicates internal audit's responsibility and ignores the operational and compliance risks (anti-bribery, integration) that the external auditor may not address. Option C follows the correct process: assess, determine impact, propose, obtain approval. C is correct.

Summary

Updating the audit plan for changing risks is about keeping internal audit relevant. The plan is a living document, built on risk, monitored continuously, adjusted when the risk landscape shifts, and governed through transparent communication with senior management and the board. On the exam, choose answers that (1) reassess risk before acting, (2) adjust the plan based on risk rather than convenience, (3) involve the board in significant changes, (4) communicate the consequences of trade-offs, (5) preserve independence, and (6) document the rationale. Master these principles and you will handle this topic confidently.