Risk-Based Internal Audit: Building an Audit Plan That Boards Actually Use
Many internal audit plans look the same every year: the same processes, audited in the same order, with the same number of days each. Boards receive long reports on petty cash and travel claims while the risks that actually keep directors awake, such as a new market, a major IT migration, a key supplier’s stability or a regulatory change, go unexamined. The plan is technically complete, but it does not help the board make decisions.
A risk-based internal audit plan fixes that by starting from the organisation’s objectives and its most significant risks, then directing audit effort where it adds the most assurance. This guide shows how to build one step by step, how to score and prioritise risks, and how to report it so that audit committees and boards actually use it.
What Is a Risk-Based Internal Audit Plan?A risk-based internal audit plan allocates internal audit time according to the significance of risks to the organisation’s objectives, rather than auditing every area on a fixed rotation. It is built from an audit universe, a documented risk assessment and input from management and the audit committee, approved by the audit committee or board, and updated during the year as risks change.
Why Traditional Audit Plans Fall Short
- Cyclical coverage spreads effort evenly, regardless of where the risk is.
- Compliance-heavy focus on transactional checks leaves strategic and operational risks untested.
- Static plans are not updated when the business changes mid-year.
- Reporting by audit instead of by risk makes it hard for boards to see the overall picture.
The Institute of Internal Auditors’ Global Internal Audit Standards, effective from January 2025, expect the chief audit executive to develop a risk-based internal audit plan, discuss it with senior management and the board, and review and update it as needed. In India, Rule 13 of the Companies (Accounts) Rules, 2014 requires the audit committee or board of companies covered by Section 138 to formulate the scope, functioning, periodicity and methodology of internal audit, in consultation with the internal auditor. ICAI’s Standards on Internal Audit also provide guidance for Indian practitioners.
Step 1: Understand Objectives and Strategy
Start with what the organisation is trying to achieve this year and over the next few years: growth plans, new products or markets, acquisitions, cost programmes, technology changes and regulatory commitments. Review the strategic plan, budget, board minutes, risk register and recent audit and regulatory reports. Every risk in the plan should connect back to an objective the board cares about.
Step 2: Build the Audit Universe
The audit universe is the full list of auditable areas. Organise it in a way that matches how the business is managed, for example:
- Business units and locations: plants, branches, subsidiaries
- Processes: order to cash, procure to pay, hire to retire, record to report, inventory, treasury
- Functions: IT, cybersecurity, data privacy, legal and compliance, tax, HR
- Projects and change initiatives: ERP implementations, new plants, acquisitions
- Third parties: critical suppliers, outsourced service providers, distributors
Step 3: Assess and Score Risks
For each auditable area, assess the inherent risk (before controls) using a small number of consistent criteria, then consider the strength of the control environment. A simple model rates impact and likelihood on a 1 to 5 scale.
| Auditable area | Impact (1–5) | Likelihood (1–5) | Inherent score | Control assessment | Priority |
|---|---|---|---|---|---|
| ERP migration project | 5 | 4 | 20 | Unknown (new system) | High |
| Procure to pay | 4 | 4 | 16 | Prior findings open | High |
| Data privacy compliance | 4 | 3 | 12 | Framework being built | High |
| Revenue and receivables | 4 | 3 | 12 | Tested last year, effective | Medium |
| Payroll | 3 | 2 | 6 | Outsourced, stable | Low |
| Fixed assets | 2 | 2 | 4 | Stable | Low |
Swipe the table sideways to see all columns.
Illustrative scores only. Impact can consider financial, regulatory, reputational, operational and strategic effects. Likelihood can consider complexity, volume, change, past incidents and fraud risk. Keep the criteria simple enough for management to understand and challenge.
Step 4: Gather Input From Stakeholders
Interview the audit committee chair, CEO, CFO, business heads, risk and compliance leaders and the statutory auditor. Ask what they worry about, what has changed, and where they would value independent assurance. This input often surfaces risks that do not appear in the risk register.
Step 5: Map Other Assurance Providers
Internal audit is not the only source of assurance. Statutory auditors test financial reporting controls, compliance teams monitor regulations, IT security teams run vulnerability tests, and external specialists may certify quality or safety. Mapping who already provides assurance on each risk avoids duplication and highlights gaps. This is often described as combined assurance, and it fits within the IIA’s Three Lines Model.
Step 6: Prioritise and Allocate Resources
Rank areas by residual risk and stakeholder priority, then decide coverage. A common approach is to audit high-priority areas every year, medium-priority areas every two years and low-priority areas on a longer cycle or through analytics, but the right cycle depends on your risk profile. Then compare required days with available resources, including in-house staff, co-sourced specialists for IT, forensic or data analytics work, and outsourced support.
If resources fall short of what the risk assessment requires, say so. The audit committee should decide whether to accept the gap or provide more resources.
Step 7: Document and Approve the Plan
The plan presented to the audit committee should be short and decision-focused:
- Key risks and how each links to objectives
- Planned audits, their objectives and timing by quarter
- Areas deliberately not covered, and why
- Resource requirements and any gaps
- Reliance on other assurance providers
- Flexibility reserved for emerging risks and special requests
Step 8: Keep the Plan Dynamic
Reserve some capacity for unplanned work, and review the plan at least every quarter. Events such as an acquisition, a fraud incident, a regulatory change, a cyber attack or a major customer loss should trigger a reassessment. Report changes to the audit committee with reasons.
Reporting That Boards Actually Use
| Instead of… | Report… |
|---|---|
| A list of every observation | Themes and root causes across audits, with the top issues highlighted |
| Process-by-process detail | A risk heat map showing assurance status for key risks |
| Generic ratings | A clear rating per audit with what it means for the business |
| “Management agreed” | Action owners, due dates and status of overdue actions |
| Activity counts | Plan completion, coverage of high risks and changes to the plan |
Swipe the table sideways to see all columns.
A one-page dashboard at the start of each audit committee pack, with detail in an appendix, usually works better than a long narrative.
Risk-Based Internal Audit Plan Checklist
- Strategy, budget and risk register reviewed
- Audit universe documented and current
- Consistent risk scoring criteria agreed with management
- Stakeholder interviews completed
- Other assurance providers mapped
- Coverage cycle and resource plan defined
- Gaps and exclusions disclosed
- Plan approved by the audit committee or board
- Quarterly review and change process in place
- Risk-based reporting format agreed
Frequently Asked Questions
What is risk-based internal auditing?
An approach that directs internal audit effort to the areas posing the greatest risk to an organisation’s objectives, rather than auditing all areas equally on a fixed cycle.
Who approves the internal audit plan?
Usually the audit committee, or the board where there is no audit committee. For companies covered by Section 138, Rule 13 requires the audit committee or board to formulate the scope and methodology in consultation with the internal auditor.
How often should the internal audit plan be updated?
It is typically prepared annually and reviewed at least quarterly, with changes when significant events or new risks arise.
What is an audit universe?
The complete list of auditable areas, such as business units, processes, functions, projects and third parties, from which the annual plan is selected.
How do you score risks for an audit plan?
Rate impact and likelihood on consistent scales, consider the strength of controls, and combine this with stakeholder input to rank areas.
Does risk-based audit mean low-risk areas are never audited?
No. Low-risk areas are covered less frequently or through analytics, and they move up if their risk profile changes.
Which standards guide internal audit planning?
The IIA’s Global Internal Audit Standards and, in India, ICAI’s Standards on Internal Audit, alongside Companies Act requirements and any sector regulator guidance.
Can internal audit be outsourced and still be risk-based?
Yes. An external internal auditor can run the risk assessment and plan, provided the audit committee stays involved in approving and monitoring it.
Plan Around Risk, Report for Decisions
An internal audit plan earns the board’s attention when it reflects the risks the board cares about. Link every audit to an objective, score risks consistently, involve stakeholders, disclose gaps and keep the plan live through the year.
This article provides general information and is not professional advice. Internal audit requirements vary by company and sector.
Build a Plan Your Board Will Use
AAPT & Associates provides risk-based internal audit services, from risk assessment and plan design to fieldwork and audit committee reporting.
Sources: The IIA: Global Internal Audit Standards · ICAI: Standards on Internal Audit · MCA: Companies Act, 2013 and Rules