What it means
The narrow meaning describes the phases of a single engagement. Planning sets the scope and identifies risks, fieldwork gathers evidence, reporting communicates findings and recommendations, and follow-up checks whether the agreed actions actually happened.
The wider meaning is a coverage schedule across the whole organisation. If a company has 48 auditable units and works to a three-year cycle, roughly 16 units are reviewed each year so that every part of the business is examined at least once in three years.
Risk should bend the cycle rather than the calendar dictating it. High-risk areas such as treasury, cash handling or a newly acquired subsidiary may sit on an annual cycle, while stable low-risk support functions can safely move to a four or five year rotation.
The external audit runs its own annual cycle tied to the reporting timetable: planning meetings, interim testing during the year, year-end fieldwork, the audit report, and then the management letter that feeds into next year's planning. Finance teams who map their close calendar against this cycle spend far less of the year responding to unexpected requests.
Follow-up is the phase most often skipped and the one that determines whether auditing changes anything. An issue marked closed on paper but never retested has a habit of reappearing at the next pass through the cycle, usually with a longer history attached.
In practice
Real-world examples.
Example
A retail group runs a three-year audit cycle across 60 store regions, so 20 regions are visited each year. When two regions record unusual stock losses, the head of audit pulls them forward out of sequence rather than waiting for their scheduled slot.
Example
A manufacturer's finance team builds its year-end close timetable around the external audit cycle, agreeing which schedules are delivered on which day. Because the auditors receive everything in the agreed order, the fieldwork finishes a fortnight earlier than the previous year.
Example
A financial services firm is required by its regulator to audit its client money controls annually rather than on the normal rotation. That single requirement consumes about 15% of the audit team's capacity every year and pushes several lower-risk areas onto a five-year cycle.
Formula
Calculation
Units audited per year = total auditable units / cycle length in years
Audit days required = units audited per year x average days per engagement
An internal audit function has identified 48 auditable units across the group and works to a three-year cycle.
48 / 3 = 16 units to be audited each year.
Each engagement takes an average of 60 audit days including planning and reporting.
16 x 60 = 960 audit days required per year.
The team has 5 auditors, each with 200 available audit days after leave, training and administration.
5 x 200 = 1,000 available audit days.
The plan fits, with 1,000 - 960 = 40 days of slack, or 4% headroom for unplanned investigations.
Now suppose a risk assessment moves 12 high-risk units onto an annual cycle while the remaining 36 stay on the three-year rotation.
36 / 3 = 12 units per year from the rotation, plus 12 annual units = 24 units per year.
24 x 60 = 1,440 audit days required, against 1,000 available, a shortfall of 440 days.
440 / 200 = 2.2 additional full-time auditors, or the equivalent bought in from a co-source provider.Case study
Seen in the real world.
Brightlane Grocers is an invented supermarket chain used here as a purely illustrative example. Its small internal audit team of four people had inherited a five-year cycle across 55 auditable units, meaning 11 reviews a year, and on paper the plan was comfortably deliverable.
The weakness showed up when a stock loss at one depot went undetected for three years. That depot had last been audited in year one of the cycle, and nothing in the schedule brought it forward despite two changes of manager and a new inventory system going live. The cycle had been treated as a rota rather than as a risk-driven plan.
Brightlane rebuilt the approach by scoring every unit for risk and splitting the population into three tiers: 10 units on an annual cycle, 20 on a two-year cycle and 25 on a four-year cycle. That gave 10 + 10 + 6.25, or roughly 26 reviews a year, well beyond the team's capacity, so the reviews themselves were shortened and standardised for the lower tiers. The illustrative point is that a cycle length is a consequence of risk and capacity, never a starting assumption.
Watch out
Common mistakes.
- Treating the cycle as a fixed rota that cannot be changed. A cycle should flex whenever risk changes, and a new system, acquisition or management change is a reason to bring a review forward.
- Counting the audit as finished when the report is issued. Follow-up is part of the cycle, and an unverified management action is a promise rather than a fix.
- Setting the cycle length before checking the team's capacity. A three-year cycle across too many units simply produces rushed engagements that give false comfort.
Questions
People also ask.
How long should an audit cycle be?
There is no universal answer, but high-risk areas are usually covered annually and low-risk areas every three to five years, with the mix constrained by the size of the team.
Is the audit cycle the same as the accounting cycle?
No, the accounting cycle describes how transactions flow into financial statements each period, while the audit cycle describes how audit work is planned, performed and followed up.
Where do special investigations fit into the cycle?
They sit outside the planned rotation and are usually funded from deliberate slack in the plan, which is why a schedule with no headroom breaks the moment something goes wrong.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related