Required Inputs
- Organization: Company name, industry, and organizational structure.
- Audit Period: Fiscal year or period covered by the audit plan.
- Available Audit Resources: Number of auditors, total available audit days, budget.
- Prior Audit Results: Previous findings, open issues, and management action plans.
- Risk Assessment Output: Enterprise risk register or risk assessment (link to
enterprise-risk-assessmentskill if needed). - Regulatory Environment: Key regulations and compliance obligations.
- Stakeholder Priorities: Board, audit committee, and management concerns.
Execution Steps
1. Define the Audit Universe
Map every auditable entity in the organization. The audit universe is exhaustive -- nothing is excluded without documented justification.
Audit Universe Categories
| Category | Examples | Typical Entities |
|---|---|---|
| Business Units | Divisions, subsidiaries, regions | 5-50 per organization |
| Core Processes | Revenue cycle, procurement, payroll, treasury | 8-15 standard processes |
| IT Systems | ERP, CRM, cloud platforms, custom applications | 10-30+ systems |
| Compliance Programs | SOX, data privacy, anti-corruption, AML | 3-10 programs |
| Third Parties | Key vendors, outsourced functions, JV partners | 5-20 critical relationships |
| Projects & Initiatives | Major transformations, M&A integration, system implementations | 2-10 active projects |
| Governance Functions | Board processes, ethics program, enterprise risk management | 3-5 functions |
Audit Universe Template
| Entity ID | Entity Name | Category | Business Owner | Last Audited | Last Rating | Risk Score | Audit Cycle |
|---|---|---|---|---|---|---|---|
| AU-001 | [Entity] | [Category] | [Role] | [Date or Never] | [Satisfactory/Needs Improvement/Unsatisfactory/N/A] | [1-25] | [Annual/Biennial/Triennial] |
2. Risk-Based Audit Prioritization
Score each auditable entity on weighted risk factors to determine audit priority.
Risk Factor Scoring Model
| Risk Factor | Weight | Score 1 (Low) | Score 3 (Medium) | Score 5 (High) |
|---|---|---|---|---|
| Financial Impact | 20% | <$1M revenue/assets | $1M-$50M | >$50M |
| Regulatory Exposure | 20% | Minimal regulatory oversight | Moderate regulation | Heavy regulation, recent enforcement |
| Operational Complexity | 15% | Simple, stable process | Moderate complexity | Highly complex, many handoffs |
| Change Velocity | 15% | No significant changes | Moderate changes (new system, reorg) | Major transformation underway |
| Prior Audit Results | 15% | Clean, no issues | Minor findings | Significant findings or repeat issues |
| Time Since Last Audit | 10% | <12 months | 12-24 months | >24 months or never audited |
| Management Concern | 5% | No concerns raised | Some concerns | Specific request from board/management |
Composite Risk Score Calculation
Composite Score = SUM(Factor Weight x Factor Score)
Range: 1.00 (lowest risk) to 5.00 (highest risk)
Priority Classification
| Priority | Composite Score | Audit Frequency | Resource Allocation |
|---|---|---|---|
| Mandatory | N/A (regulatory) | Annual | As required |
| Priority 1 | 4.01 - 5.00 | Annual | Full-scope audit |
| Priority 2 | 3.01 - 4.00 | Annual or biennial | Full or targeted audit |
| Priority 3 | 2.01 - 3.00 | Biennial or triennial | Targeted or limited review |
| Priority 4 | 1.00 - 2.00 | Triennial or risk-monitored | Continuous monitoring only |
3. Annual Audit Plan Construction
Translate prioritized entities into a resourced, scheduled audit plan.
Resource Allocation Formula
Available Audit Days = (Number of Auditors x Working Days) - Training - Admin - Carry-forward
Typical: 1 auditor = 220 working days - 20 training - 30 admin = 170 available audit days
Engagement Effort Estimates
| Engagement Type | Typical Duration (Days) | Team Size | Total Effort |
|---|---|---|---|
| Full-scope audit | 15-30 | 2-3 | 30-90 days |
| Targeted/focused audit | 8-15 | 1-2 | 8-30 days |
| Follow-up review | 3-5 | 1 | 3-5 days |
| Continuous monitoring | Ongoing | 0.5 FTE | 85 days/year |
| Advisory/consulting | 5-15 | 1-2 | 5-30 days |
| Investigation | Variable | 2-3 | 20-60 days |
Annual Audit Plan Template
| Engagement ID | Entity | Type | Objective | Q1 | Q2 | Q3 | Q4 | Lead Auditor | Est. Days | Priority |
|---|---|---|---|---|---|---|---|---|---|---|
| IA-2025-001 | [Entity] | Full-scope | [Objective] | X | [Name/Role] | [Days] | P1 | |||
| IA-2025-002 | [Entity] | Targeted | [Objective] | X | [Name/Role] | [Days] | P1 |
Plan Coverage Analysis
Audit Universe Coverage = Entities Planned for Audit / Total Entities in Universe
Target: 100% coverage within a 3-year rolling cycle
Annual coverage target: 33-50% of audit universe
4. Audit Scope and Objectives Framework
For each engagement, define scope, objectives, and approach before fieldwork begins.
Engagement Planning Memo Template
| Element | Detail |
|---|---|
| Engagement Title | [Descriptive title] |
| Auditable Entity | [From audit universe] |
| Audit Objective | [What the audit will assess -- controls, compliance, efficiency] |
| Scope Period | [Transaction period under review] |
| Scope Boundaries | [In scope / out of scope] |
| Key Risks | [Top 3-5 risks from risk assessment] |
| Audit Criteria | [Standards, policies, regulations against which to assess] |
| Methodology | [Interviews, walkthroughs, sample testing, data analytics] |
| Timeline | [Fieldwork start/end, draft report, final report] |
| Team | [Lead, staff, specialists] |
| Budget | [Planned hours/days] |
5. Control Testing Methodology
Test controls for both design effectiveness and operating effectiveness.
Phase A: Design Effectiveness (Does the control address the risk?)
| Test | Question | Evidence |
|---|---|---|
| Control objective alignment | Does the control directly mitigate the identified risk? | Policy, procedure documentation |
| Completeness | Are all key risk scenarios addressed by at least one control? | Control-risk matrix |
| Authority and segregation | Are appropriate approvals and segregation of duties in place? | Org chart, access matrix |
| Timeliness | Is the control performed at the right frequency? | Procedure documentation |
| Information quality | Does the control use reliable, complete information? | Data source analysis |
Phase B: Operating Effectiveness (Is the control working as designed?)
| Test Type | When to Use | Example |
|---|---|---|
| Inquiry | Always (but never alone) | Interview the control operator about how they perform the control |
| Observation | Real-time processes | Watch a supervisor review and approve journal entries |
| Inspection | Document-based controls | Examine signed approvals on purchase orders |
| Reperformance | Calculated/automated controls | Independently recalculate a reconciliation |
| Data analytics | High-volume transactions | Run full-population analysis on payment data |
Control Conclusion Matrix
| Design Effective? | Operating Effective? | Overall Conclusion |
|---|---|---|
| Yes | Yes | Effective -- rely on control |
| Yes | No | Operating deficiency -- finding required |
| No | Not tested | Design deficiency -- finding required |
| No | N/A | Material weakness candidate |
6. Sampling Methodology
Sample Size Guidance (Attribute Testing)
| Population Size | Expected Deviation Rate 0% | Expected Deviation Rate 1-2% | Expected Deviation Rate 3-5% |
|---|---|---|---|
| < 50 | Test all | Test all | Test all |
| 50-100 | 25-30 | 30-40 | 40-50 |
| 101-500 | 25-30 | 30-45 | 45-60 |
| 501-2,000 | 25-30 | 35-50 | 50-60 |
| 2,001-10,000 | 25-30 | 40-55 | 55-60 |
| > 10,000 | 25-30 | 45-60 | 58-60 |
Sampling Method Selection
| Method | When to Use |
|---|---|
| Random | Standard attribute testing, unbiased population |
| Stratified | Population has distinct subgroups (e.g., by dollar amount or location) |
| Haphazard | Quick directional testing only, not for formal conclusions |
| Judgmental | Targeted high-risk items (large dollar, unusual transactions) |
| Full population (data analytics) | Preferred when feasible -- eliminates sampling risk entirely |
7. Audit Finding Severity Classification
Align with the practice risk rating scale but add audit-specific context.
| Severity | Definition | Management Response Timeline | Escalation |
|---|---|---|---|
| Critical | Control failure that has resulted in or could imminently result in material financial loss, regulatory sanction, or safety incident. Immediate executive and audit committee notification required. | Immediate action plan; remediation within 30 days | Audit Committee, CEO |
| High | Significant control deficiency with high likelihood of material impact if not remediated. No compensating controls in place. | Action plan within 5 business days; remediation within 60 days | CAE, CFO, relevant C-suite |
| Medium | Moderate control weakness. Compensating controls partially mitigate risk. Repeat finding elevates to High. | Action plan within 10 business days; remediation within 90 days | CAE, business unit head |
| Low | Minor control improvement opportunity. Unlikely to result in material impact. Best practice recommendation. | Addressed in normal course; remediation within 180 days | Audit management, process owner |
| Advisory | Observation or efficiency recommendation. Not a control deficiency. | Optional | Process owner |
8. Reporting Templates
Individual Audit Report Structure
## Internal Audit Report: [Engagement Title]
### Report ID: [IA-YYYY-NNN]
| Field | Detail |
|---|---|
| Entity Audited | [Name] |
| Audit Period | [Start - End] |
| Report Date | [Date] |
| Overall Rating | [Satisfactory / Needs Improvement / Unsatisfactory] |
| Lead Auditor | [Name] |
| Distribution | [Names and roles] |
### Executive Summary
[2-3 paragraph summary: scope, key findings, overall opinion]
### Overall Opinion
[Satisfactory / Needs Improvement / Unsatisfactory] with basis for opinion.
### Scope and Methodology
- Objectives: [What we assessed]
- Period: [Transaction dates reviewed]
- Methodology: [Testing approach]
- Limitations: [Any scope restrictions]
### Findings and Recommendations
#### Finding 1: [Title]
| Attribute | Detail |
|---|---|
| Severity | [Critical/High/Medium/Low] |
| Condition | [What we found] |
| Criteria | [What should be] |
| Cause | [Why the gap exists] |
| Effect | [Actual or potential impact] |
| Recommendation | [What to do] |
| Management Response | [Agree/Disagree + action plan] |
| Target Date | [Remediation deadline] |
| Responsible Owner | [Name and role] |
### Appendices
- A: Detailed test results
- B: Population and sample details
- C: Documents reviewed
Quarterly Audit Committee Summary
## Internal Audit Quarterly Report to Audit Committee
### Period: [Q# FY####]
### Plan Execution Status
| Metric | Target | Actual | Variance |
|---|---|---|---|
| Audits completed | [#] | [#] | [+/-] |
| Audit days used | [#] | [#] | [+/-] |
| Plan completion (YTD) | [%] | [%] | [+/-] |
### Completed Audits This Quarter
| Engagement | Rating | Critical | High | Medium | Low |
|---|---|---|---|---|---|
| [Name] | [Rating] | [#] | [#] | [#] | [#] |
### Open Findings Aging
| Aging Bucket | Critical | High | Medium | Low | Total |
|---|---|---|---|---|---|
| Current (within target date) | [#] | [#] | [#] | [#] | [#] |
| Overdue 0-30 days | [#] | [#] | [#] | [#] | [#] |
| Overdue 31-90 days | [#] | [#] | [#] | [#] | [#] |
| Overdue > 90 days | [#] | [#] | [#] | [#] | [#] |
### Key Themes and Emerging Risks
[Narrative on patterns across audits, new risks identified]
### Plan Amendments
[Any changes to the annual plan with rationale]
### Resource and Budget Update
[Staffing, co-source usage, budget status]
9. Follow-Up and Issue Tracking Framework
Issue Lifecycle
Finding Issued --> Management Response (5-10 days) --> Action Plan Agreed
--> Implementation In Progress --> Validation Testing --> Closed / Escalated
Follow-Up Cadence
| Finding Severity | Follow-Up Frequency | Validation Method |
|---|---|---|
| Critical | Every 2 weeks until closed | Full retest required |
| High | Monthly until closed | Full retest required |
| Medium | Quarterly until closed | Evidence review + targeted retest |
| Low | Semi-annually | Evidence review |
Escalation Protocol
| Trigger | Action |
|---|---|
| Management response not received within deadline | Escalate to next management level |
| Target date missed once | Extend with CAE approval; report to audit committee |
| Target date missed twice | Mandatory audit committee agenda item |
| Finding open > 12 months | Automatic escalation to audit committee chair |
| Management accepts risk (no remediation) | Document risk acceptance with sign-off at appropriate level |
10. Quality Assurance and Improvement Program (QAIP)
Per IIA Standard 1300 -- maintain a QAIP covering all aspects of the internal audit activity.
Internal Assessments (Ongoing + Periodic)
| Assessment Type | Frequency | Performed By | Focus |
|---|---|---|---|
| Engagement supervision | Every engagement | Audit management | Workpaper review, conclusion support |
| Post-engagement survey | Every engagement | Auditee feedback | Professionalism, communication, value |
| KPI monitoring | Monthly | CAE | Plan completion, cycle time, findings trends |
| Self-assessment | Annually | Audit team | Conformance with IIA Standards |
External Assessment
| Requirement | Detail |
|---|---|
| Frequency | At least every 5 years (IIA Standard 1312) |
| Performed By | Qualified, independent assessor or assessment team |
| Scope | Full conformance with IIA Standards and Code of Ethics |
| Output | Opinion: Generally Conforms / Partially Conforms / Does Not Conform |
| Reporting | Results reported to audit committee |
Key Performance Indicators (KPIs)
| KPI | Target | Measurement |
|---|---|---|
| Audit plan completion rate | >= 90% | Completed audits / planned audits |
| Report cycle time | <= 15 business days from fieldwork end | Average days to final report |
| Finding closure rate | >= 80% closed on time | On-time closures / total closures |
| Stakeholder satisfaction | >= 4.0 / 5.0 | Post-engagement survey average |
| Repeat finding rate | <= 10% | Repeat findings / total findings |
| Budget variance | +/- 10% | Actual vs. planned audit days |
11. Audit Committee Communication Protocol
Standing Agenda Items (Quarterly)
- Audit plan execution status and any proposed amendments
- Completed audit results with ratings and significant findings
- Open findings aging and overdue issue escalation
- Emerging risks identified through audit activities
- Resource and budget update
- External audit coordination summary
Ad Hoc Communications (Triggered by Events)
| Trigger | Communication | Timeline |
|---|---|---|
| Critical finding identified | Immediate notification to audit committee chair | Within 24 hours of confirmation |
| Fraud or suspected fraud | Immediate notification to audit committee chair and general counsel | Within 24 hours |
| Scope limitation imposed by management | Written notification to audit committee | Within 5 business days |
| Significant change to audit plan | Approval request with rationale | Before implementation |
| CAE independence threat | Direct communication to audit committee chair | Immediately |
Output Template
## Internal Audit Plan: [Organization] -- [Fiscal Year]
### Approved By
| Role | Name | Date |
|---|---|---|
| Chief Audit Executive | [Name] | [Date] |
| Audit Committee Chair | [Name] | [Date] |
### Audit Universe Summary
| Category | Total Entities | P1 | P2 | P3 | P4 | Mandatory |
|---|---|---|---|---|---|---|
| Business Units | [#] | [#] | [#] | [#] | [#] | [#] |
| Core Processes | [#] | [#] | [#] | [#] | [#] | [#] |
| IT Systems | [#] | [#] | [#] | [#] | [#] | [#] |
| Compliance Programs | [#] | [#] | [#] | [#] | [#] | [#] |
| Third Parties | [#] | [#] | [#] | [#] | [#] | [#] |
| Projects | [#] | [#] | [#] | [#] | [#] | [#] |
| **Total** | [#] | [#] | [#] | [#] | [#] | [#] |
### Resource Budget
| Resource Category | Days |
|---|---|
| Total available audit days | [#] |
| Planned engagements | [#] |
| Follow-up reviews | [#] |
| Advisory/consulting reserve | [#] |
| Investigation reserve | [#] |
| Training and development | [#] |
| Administration | [#] |
| Unallocated reserve (contingency) | [#] |
### Annual Audit Plan
| ID | Entity | Type | Objective | Quarter | Lead | Days | Priority |
|---|---|---|---|---|---|---|---|
| IA-YYYY-001 | [Entity] | [Type] | [Objective] | Q# | [Lead] | [#] | [P#] |
### Three-Year Rolling Coverage
| Entity | Current Year | Year +1 | Year +2 | Cycle |
|---|---|---|---|---|
| [Entity] | Full audit | Monitor | Targeted | Biennial |
### Key Risk Themes Driving the Plan
1. [Theme]: [Which audits address this risk]
2. [Theme]: [Which audits address this risk]
### QAIP Summary
[Current conformance status, planned assessments, KPI targets]
Quality Checks
- Audit universe is exhaustive -- all business units, processes, IT systems, compliance programs, third parties, and projects identified.
- Risk-based prioritization uses weighted, documented scoring -- not gut feel.
- Resource allocation is mathematically feasible (planned days <= available days with contingency reserve).
- Every engagement has a defined objective, scope, and methodology.
- Control testing covers both design effectiveness and operating effectiveness.
- Sampling methodology is documented and defensible.
- Finding severity classification aligns with the practice risk rating scale (Critical/High/Medium/Low).
- Individual audit reports use the Condition-Criteria-Cause-Effect format.
- Quarterly audit committee reporting covers plan status, findings aging, and emerging risks.
- Follow-up cadence matches finding severity with defined escalation triggers.
- QAIP includes both internal assessments (ongoing) and external assessment (every 5 years per IIA Standard 1312).
- Three-year rolling coverage ensures 100% audit universe coverage within the cycle.