Build and update a risk-based internal audit plan
A risk-based internal audit plan selects engagements from the organization’s objectives, risk assessment, assurance needs, and available resources. It must respond to material change. An annual list is a starting commitment, not a reason to ignore a new exposure that makes the original priorities obsolete.
From audit universe to engagement portfolio
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Universe and information | Identify relevant activities and consider risk, change, stakeholder requests, and required coverage. | Limiting the universe to departments audited last year. |
| Priorities and resources | Select work that addresses significant assurance needs with suitable capacity. | Ranking only by ease of completion. |
| Updates and approval | Reassess significant changes and communicate proposed plan adjustments through the approval process. | Letting a fixed calendar override a newly material risk. |
Universe and information
Identify relevant activities and consider risk, change, stakeholder requests, and required coverage.
Avoid: Limiting the universe to departments audited last year.
Priorities and resources
Select work that addresses significant assurance needs with suitable capacity.
Avoid: Ranking only by ease of completion.
Updates and approval
Reassess significant changes and communicate proposed plan adjustments through the approval process.
Avoid: Letting a fixed calendar override a newly material risk.
A decision path you can use
- 1Identify assurance needs
- 2Prioritize and resource engagements
- 3Reassess when the risk picture changes
Understand the method
Work through the reasoning
Understand the organization before ranking engagements
The audit universe should reflect relevant objectives, activities, systems, entities, and risks. It is not simply last year’s list of departments. Consider significant change, required coverage, stakeholder input, incidents, and existing assurance. An acquisition or new digital channel may create exposure that an old organizational chart misses.
A documented assessment gives the plan a defensible basis. Consider both inherent exposure and the information available about risk management and controls. A low rating supplied by a process owner is an input to evaluate, not an automatic reason to omit the area.
Prioritize assurance needs across the portfolio
Compare proposed engagements by their contribution to significant assurance needs, considering requirements, timing, prior findings, and available coverage. A numerical ranking can help organize judgment, but its assumptions and data need scrutiny. Small differences in scores should not imply more precision than the model supports.
Explain why selected work deserves the available resources and what remains outside the plan. Consider whether coordination with other providers can improve coverage. Reliance requires evaluation of that work; simply naming another provider does not establish that an assurance gap is filled.
Connect the proposed plan to realistic resources
Translate the portfolio into the skills, capacity, technology, and budget needed to deliver it. Include supervision, quality work, follow-up, and other necessary function activities when evaluating availability. A schedule can look feasible if it counts every paid hour as engagement testing, yet fail in practice.
Communicate the effect of resource limitations on risk coverage to the appropriate stakeholders. Present options and consequences rather than quietly removing difficult work. Obtain board approval of the plan and significant changes in accordance with the Standards and the function’s arrangements.
Update the plan when the risk assessment changes
A risk-based plan needs timely reassessment when significant events occur. An acquisition, major incident, new strategy, or control failure may change priorities. Evaluate the event in context rather than automatically replacing every scheduled engagement with the newest concern.
For a proposed change, identify added or deferred work, the risk rationale, resource implications, and remaining coverage. Preserve a clear history of decisions. The purpose of updating is to keep assurance relevant while maintaining accountable oversight of the portfolio.
Original teaching example
Apply the method to a decision
The scenario
After the annual plan is approved, the company acquires a business with a different payment platform and limited integration controls.
The decision
Reassess the new exposure and propose a documented plan change if its priority warrants it.
Identify what work should be added, deferred, or coordinated and explain the effect of resource constraints. The acquisition does not automatically require abandoning every planned engagement, but it does require a fresh risk judgment.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A new acquisition competes with required coverage
The situation
An acquisition introduces a poorly understood payment system. The team proposes canceling a required engagement to free resources without assessing other options.
Reason through it
The new exposure deserves reassessment, but mandatory or otherwise required coverage cannot be dismissed without understanding the obligation. Compare timing, specialist support, lower-priority deferrals, and coordination options.
Take the decision
Present a risk-informed portfolio decision that accounts for both the acquisition and existing obligations.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Is the internal audit plan the same as an engagement work program?
No. The plan selects and schedules work across the function. A work program specifies procedures within a particular engagement. They operate at different levels and need different evidence.
Should every new risk immediately replace planned work?
No. Reassess its significance alongside obligations, existing priorities, available assurance, and resources. Change the plan when the evidence warrants it and make the resulting coverage tradeoffs explicit.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Internal Audit Plan (15% of Part 3). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 9.4-9.5. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.