Risk-based internal audit plan and annual risk assessment

Standard 9.4 sets the minimum: the assessment is documented, it rests on the organization's strategies, objectives and risks, it takes input from the board and senior management, and it is performed at least annually. Standard 9.1 adds that the chief audit executive must first understand how the organization sets objectives, oversees risk and control, promotes an ethical culture and coordinates its assurance providers.

In practice the inputs are:

• Interviews with the CEO, CFO, controller and the heads of operations, sales and IT, asking what would stop the company reaching its objectives this year.
• Results: margin by line, the largest balance sheet accounts and anything that moved sharply.
• Contracts: covenants, grant conditions and customer terms that carry a penalty.
• History: prior auditor management letters, past incidents and open findings.
• The risk register, if one exists, and the board's stated risk appetite.

Every input is logged in the assessment so that the committee, or a later quality assessor, can see why an area ranked where it did.

The audit universe is the full list of areas internal audit could examine. Ranking it forces a choice about what the committee funds first. The table below is illustrative: the areas and ranks are an example of the format, not findings about any company.

Areas that rank high on both axes go first. Areas that rank high on impact and low on likelihood get a lighter test or a scheduled revisit. Areas that rank low on both stay in the universe and are re-scored next year.

Impact and likelihood on a three- or five-point scale are enough. A composite score such as 17.4 suggests a precision the inputs do not have. The assessment records the scale definitions in plain words (for example, what counts as high impact in dollars of margin or days of delay) and the reason for each score in a sentence, so a reviewer can disagree with a score and see what to change.

Two checks keep the ranking honest. First, the leadership team scores independently before the group discusses, because the first number spoken in a room anchors the rest. Second, the audit committee is invited to override: a risk the board cares about but management rates low goes on the plan with the disagreement noted. The Standards expect the plan to reflect the board's expectations as well as management's view.

Standard 8.1 lists what the chief audit executive reports to the board and senior management: the plan and budget and later significant revisions, changes affecting the mandate or charter, potential impairments to independence, the results of internal audit services, and the results of the quality assurance program. Standard 11.3 says results are communicated periodically and for each engagement as appropriate, and that the chief audit executive must understand the board's expectations on nature and timing.

The Standards' implementation guidance notes that formal board meetings typically allow communication at least quarterly, and that the board and the chief audit executive should meet at least annually without management present, with quarterly sessions described as a leading practice. A sensible calendar for a small function is a status page at each regular committee meeting, a full report after each audit, an annual plan refresh and one closed session a year. The plan page lists the dates so the committee can track them.

The ACFE's 2024 study of 1,921 cases found that tips were the most common way fraud came to light, at 43% of cases, more than three times as many as any other method. Internal audit was the detection method in 14% and management review in 13%. Organizations with hotlines were nearly twice as likely to detect fraud through a tip as organizations without one.

For a plan, that points to a test that is easy to skip: does a reporting channel exist, do employees know it, who receives a report, and what happens in the first week after one arrives. The audit tests the answer with a sample of how past reports were handled and a walkthrough of the channel itself. It does not investigate any report it finds.

Internal audit support here is planned and reported against the IIA Global Internal Audit Standards for management and the audit committee. Conformance is the chief audit executive's to demonstrate through the function's quality program. It is not an external audit, review, compilation or attestation, and Finbryn gives no opinion on financial statements or on internal control over financial reporting under AICPA or PCAOB standards.

A plan is a statement of intended coverage. It is not a promise that fraud will be found, a clean report on any area or a substitute for the annual outside audit. If the committee wants assurance on the financial statements, an independent public accounting firm provides it. Finbryn drafts the plan for the committee to approve and does not approve it for them.