How to Build a Risk-Based Internal Audit Plan

A risk-based internal audit plan is an annual work programme that starts from an audit universe covering all auditable areas, rates those areas against defined risk criteria, sets priorities and directs limited audit capacity to the highest-risk areas. A good plan is linked to the expectations of the board and the audit committee, to the company’s strategic objectives and to a changing risk environment. This article sets out the steps in preparing such a plan, consistent with the general approach of the Global Internal Audit Standards issued by The Institute of Internal Auditors (IIA).

What does risk-based internal auditing mean?

Risk-based auditing means that audit activity is determined by risk priority rather than by calendar or habit. Instead of reviewing every unit with the same depth each year, the function concentrates on areas that most threaten the achievement of the organisation’s objectives. The Global Internal Audit Standards likewise expect the internal audit plan to rest on a documented risk assessment and to stay aligned with the board’s expectations.

How is the audit universe built?

The audit universe is the list of all processes, units, systems, subsidiaries and projects that could fall within internal audit’s scope. The starting points are the organisation chart, process maps, strategy documents and previous audit findings. Discussions with management and external factors complete the picture.

The universe may include financial and operational processes, information technology, regulatory compliance, and fraud and ethics risks. In holdings, group companies and shared service centres should also be included. The universe is a living document and should be updated after new business lines, acquisitions or system changes.

Which criteria are used in the risk assessment?

Each auditable area is scored against criteria that are set in advance and understood by management. Criteria vary by company, but most frameworks include the following:

• Impact: the scale of financial, operational, reputational or legal consequences if the risk materialises.
• Likelihood: the probability of occurrence and past incidents.
• Strength of the control environment: adequacy of the design and operation of existing controls.
• Complexity and change: process complexity, new systems, reorganisations and staff turnover.
• Prior audit results: time since the last audit and open findings.
• Regulatory and stakeholder sensitivity: regulatory attention, public exposure and investor expectations.

The risk assessment should not be a desk exercise by the audit team alone. Conversations with senior management, process owners and, where it exists, the enterprise risk management function increase its reliability. Internal audit may draw on management’s own risk assessment but should validate those inputs with its independent judgement.

How are audit priorities set?

After scoring, areas are ranked by risk level. High-risk areas are covered every year or at short intervals, medium-risk areas on a defined cycle, and low-risk areas less often or on request. Judgement matters more than mechanical ranking here: an area that scores low may enter the plan because of a recent incident or a management request.

Overlaps and gaps among assurance providers are also assessed at this stage. When the areas covered by the external auditor, compliance, quality and risk management functions are known, internal audit can avoid duplication and direct its resources to where it adds most value.

How are the annual plan and resources structured?

Priority areas are translated into a realistic timetable given available resources. The number of auditors, their areas of expertise, any need for specialist skills such as information technology or data analytics, and planned training are all taken into account. Where resources cannot cover the full plan, the areas left out and the risk implications should be reported clearly to the audit committee.

Flexibility should be built in for special reviews, emerging risks and plan changes during the year. Changes should be documented with reasons and communicated to the committee. Where appropriate, outsourcing or co-sourcing is a complementary option, especially for technical subjects.

How does internal audit report to the audit committee?

The annual audit plan is approved by the audit committee or the board. Approval reinforces the independence of internal audit and shows that the plan matches senior expectations. Regular reporting during the year should cover progress against the plan, significant findings, management’s actions and resource adequacy.

A good report does not merely list findings; it explains in plain language what the risk is, its root cause, its business impact and the recommended action. Committee members want the summary that will guide their decisions, not every detail behind each finding.

How do the Global Internal Audit Standards frame planning?

The Global Internal Audit Standards are organised around the purpose of internal auditing, ethics and professionalism, governing the function, managing the function and performing audit services. For planning, the key themes are that the plan rests on a documented risk assessment, aligns with the organisation’s strategy and objectives, is reviewed and approved by the board, and that any resource shortfall is communicated openly.

The Standards guide through principles rather than prescriptive rules. The level of detail in the plan, the weighting of risk criteria and the audit methods therefore depend on the size and complexity of the organisation. What matters is that choices are reasoned and documented.

Why is follow-up part of the plan?

Audit creates value when a finding is closed, not when it is written. For each finding there should be an owner, a target date and an action plan, and internal audit should monitor whether actions are implemented. Overdue or recurring findings should be made visible to the committee.

Follow-up results also feed the next year’s risk assessment: areas where actions proved ineffective are rated higher. The plan thus becomes a continuous cycle rather than a one-year calendar.

What are common planning mistakes?

• Copying last year’s plan without updating the risk assessment.
• Focusing only on financial processes while leaving technology, compliance and ethics risks out.
• Treating the plan as fixed and leaving no room for emerging risks.
• Narrowing the scope quietly without telling the committee about resource gaps.

In the end, a good plan shows not only what auditors will do but also where the board receives assurance and where it does not. That transparency is one of its most valuable outputs and strengthens the committee’s oversight role.

This article is for general information and is not professional advice; if you would like to review your internal audit plan, we would be glad to talk with you at Hector Kurumsal.