Developing a Risk-Based Audit Plan

Sorry, but you do not have permission to view this content.

Expand all sectionsCollapse all sections

Module1: Introduction to Risk-Based Audit Planning
Risk-based internal audit planning aligns the audit function with strategy, objectives, and key risks. It ensures efficient allocation of limited audit resources and Standard 9.4 requires the Chief Audit Executive (CAE) to base the plan on a documented risk assessment.
3
Module 2: Planning Fundamentals
This module deals with engaging with board and senior management, clarifying expectations: reporting frequency, criteria, change approvals, and considering assurance providers and external risk environment (eg assurance mapping).
3
Module 3: Why Risk-Based Internal Audit Planning
3

Basic knowledge of internal auditing – understanding of audit objectives, processes, and reporting.
Familiarity with risk management concepts – awareness of risk categories (strategic, operational, financial, compliance, IT).
Experience with audit engagements – at least some exposure to audit fieldwork or planning.
Understanding of organizational governance – awareness of how strategy, risk, and controls connect.
Optional but helpful: Prior exposure to the IIA Standards, COSO ERM, or ISO 31000 frameworks.

Chief Audit Executives (CAEs) – responsible for developing and presenting the internal audit plan to the board.
Internal Audit Managers and Team Leaders – overseeing audit planning, risk assessments, and engagement prioritization.
Internal Auditors – seeking to strengthen their knowledge of risk-based planning and apply practical tools.
Risk and Compliance Professionals – who want to understand how internal audit integrates with enterprise risk management.
Governance Professionals and Board Members – interested in how risk-based audit planning enhances assurance and oversight.