Internal Audit Plan

A business has more processes than its audit team can review in one year, so a plan helps it choose where independent assurance will be most useful, such as cyber access, cash handling or a major new operation. Begin with the audit universe: the important entities, processes, systems and obligations that might be reviewed.

Compare that list with strategy, recent changes, incidents, previous findings and management's risk assessment, because an old annual calendar alone is a weak basis for choosing work. The Institute of Internal Auditors' 2025 guide describes a systematic approach to creating and maintaining a risk-based plan, and its Global Internal Audit Standards make strategic planning, resources and board interaction part of managing the function.

Risk scoring can help prioritise, weighing likelihood and impact alongside speed of change, control maturity and the quality of other assurance. Do not confuse a risk register with an audit plan: management owns the risks and controls, while internal audit independently chooses how to evaluate them within its mandate.

Consult stakeholders without surrendering independence, asking executives and the audit committee what is changing and where they lack confidence. Specify the purpose of each proposed engagement; a review of procurement might focus on vendor selection and conflicts rather than every purchase order.

Record enough scope to estimate effort while leaving detailed procedures to the engagement-planning stage. Estimate capacity realistically, including audit days, specialist skills, leave, training, follow-up work and time for unplanned investigations.

A plan requiring 1,400 days from a team that can deliver 900 is not a promise; it hides a resource gap. Show trade-offs as well: if the board wants more cybersecurity assurance but has no specialist auditor, the chief audit executive can discuss training, co-sourcing or deferred work rather than quietly labelling an unstaffed audit 'planned' to make a coverage chart look complete.

Consider coordination with other assurance providers, because compliance, quality, external audit and regulators may inspect related processes. Their work can inform planning, but internal audit should evaluate whether it can rely on the scope, methods and independence of that work.

The board or audit committee normally has an oversight role in approving or reviewing the plan under the organisation's framework, so confirm the charter and applicable standards; management can comment on feasibility without being the sole gatekeeper for audits of its own decisions. Publish a practical schedule internally so process owners know when preparation is likely, while recognising that precise fieldwork dates can move.

Keep a contingency allowance, because a fraud allegation, acquisition or major outage may need urgent work, and document why work was added, delayed or cancelled and discuss material changes through the agreed oversight process. Review priorities throughout the period, since a new system, change of law or business acquisition can make an older risk score stale, and ask what was left out and why, which helps governance make informed choices rather than offering false certainty.