Every great audit starts with a great plan. Risk-based audit planning is both art and science — knowing which systems deserve the most scrutiny, how to define the right scope, and how to design tests that actually reveal the truth.
The audit universe is the complete inventory of all auditable entities — systems, processes, departments, controls — that the internal audit function could potentially audit. A mature internal audit function maintains and updates its audit universe annually, using it as the starting point for risk-based audit plan development.
Not everything in the audit universe gets audited every year. Risk-based planning selects which areas to audit based on: inherent risk level, time since last audit, recent changes (new system, new vendor, new regulation), management concerns, and regulator expectations. High-risk areas with no recent audit get priority. Low-risk stable areas may go 2–3 years between audits.
Scope defines what is in and what is out of the audit. Scope creep — gradually expanding the audit beyond its defined boundaries — is one of the most common audit execution failures. A well-defined scope includes: system/process name, time period, locations, and specific controls or assertions to be tested. Objectives state what the audit will conclude about.
An audit program is the detailed playbook for executing the audit. For each control to be tested, the program specifies: the control objective, the specific test procedure, evidence to be gathered, population size, sample methodology, and the test of design vs operating effectiveness.
IIA Standard 2010 (Engagement Planning) requires the Chief Audit Executive to establish risk-based plans to determine the priorities of the internal audit activity. Key requirements:
Audit plans must be based on a documented risk assessment. Plans driven by management request or historical rotation (without risk justification) do not meet IIA standards.
Plans must consider management's goals, strategic initiatives, and concerns. Audit that ignores business context is less valuable and less likely to receive cooperation.
The annual audit plan must be reviewed and approved by the audit committee. This ensures appropriate governance oversight of internal audit activity.
Plans should be responsive to significant risk changes during the year. Emerging risks (new breach type, regulatory change, acquisition) may require unplanned audits. A rigid plan cannot adapt.
When a population is too large to test 100%, auditors use sampling. Choosing the right sampling method is critical to drawing valid conclusions:
| Method | Basis | Conclusion | Best For |
|---|---|---|---|
| Random Sampling | Every item has equal probability of selection | Statistically defensible conclusion about the whole population | Large homogeneous populations (all access provisioning tickets) |
| Stratified Sampling | Population divided into groups (strata); samples from each | Proportional conclusions about different segments | Populations with distinct risk groups (admin accounts vs regular users) |
| Systematic Sampling | Every nth item selected (e.g., every 10th) | Statistically valid if no pattern in the nth interval | Ordered populations (transaction logs, change tickets) |
| Judgmental Sampling | Auditor selects items based on knowledge and risk | Not statistically generalizable — conclusions limited to tested items | Targeted testing of high-risk specific items |
| Attribute Sampling | Tests whether an attribute is present/absent in a binary way | Estimated deviation rate for the population within confidence bounds | Testing whether controls were applied consistently |
For compliance auditing (SOX, PCI-DSS), statistical sampling with documented confidence levels and error rates provides the most defensible conclusions. For risk-focused internal auditing, judgmental sampling can efficiently target the highest-risk items.
Real audits rarely have unlimited time. Scoping under constraints requires professional judgment:
Identify the top-risk controls within the area. Scope the audit to fully test those. Use inquiry and walkthrough for medium-risk controls. Exclude low-risk controls from testing (document the exclusion rationale).
If a control was tested last year with no exceptions, and nothing has changed, the auditor may be able to reduce the current year sample. Document the reliance rationale and prior findings.
When scope is limited due to resource constraints, the audit report must disclose the limitation. Recipients need to understand what was and was not tested to properly interpret the findings.
If during planning you identify a high-risk issue, scope should be expanded to cover it — even at the expense of lower-risk planned areas. Issue-driven scope adjustments should be documented and approved.
An audit program is only as good as its test procedures. Effective test procedures are:
"Verify that user access is reviewed quarterly" is weak. "Select 25 random user accounts from the Active Directory export as of [date]. For each, verify: (1) An access review approval email exists in the ticketing system, (2) dated within the prior 90 days, (3) signed by the resource owner."
Every test procedure must trace back to the specific control objective it tests. Orphaned test procedures (testing something with no clear objective) waste resources and produce unusable results.
The program should specify what evidence will be collected for each test. "Screenshot of configuration setting," "Signed access review form," "System-generated user list" — defining evidence type in advance avoids fieldwork inefficiency.
Define what constitutes a pass and what constitutes an exception before testing begins. If pass/fail is defined after seeing results, the auditor's judgment may be unconsciously influenced by expectations.
You are leading the internal audit of a payroll system that processes $48M in annual payroll for 1,800 employees. Build a complete, professional-grade audit plan using the risk-based audit planning methodology — from objective through sampling through reporting.