Glossary term
Audit Plan
Subject: Governance, Internal Control and Audit
Also known as: Annual Audit Plan, Internal Audit Plan
An audit plan is a document setting out which areas the internal audit function will review over a period, usually a year, when, with what resources and why, based on an assessment of risk.
Explanation
The head of internal audit builds it after consulting the board, audit committee and senior management, and the audit committee approves it. The starting point is the audit universe, a list of every auditable unit, process and system. The team ranks these by risk, past findings, regulatory demand and time since last review. The plan assigns reviews to quarters, estimates hours, and keeps spare capacity for special requests and new risks. It is revised during the year as risks change, and changes go to the committee. Each engagement then gets its own plan covering scope, objectives and approach. Some plans run over several years, visiting high risks every year and lower ones in a cycle. The plan shows the board whether audit effort follows risk.
Example
The head of internal audit at a regional bank lists 60 auditable areas and ranks them by risk. She schedules 18 reviews for the year, placing lending, cyber controls and anti-money laundering in the first half. After a fraud at a peer bank in June, the audit committee approves swapping one low-risk review for a review of cheque handling.
Not to be confused with
- Audit programme
- A programme is the detailed set of test steps for one review. The plan lists the reviews across the whole period.