An annual internal audit plan is a list of the audits the function will do in the year, why each was picked, how many days it gets, and when it will be done. A risk-based plan picks audits by what could go wrong and how much it would hurt, then fits them into the days actually available. The audit committee approves it, and it can change during the year.
Last reviewed: 17 October 2026. Facts checked. We opened our own site posts on audit universe, risk register and audit programme to align terms. We did not open the ICAI Standards on Internal Audit or the IIA standards for this post, so no paragraph numbers are quoted. All company details, scores and day counts in the example are invented and labelled as such. Nothing here is a statutory requirement unless stated.
Plan, programme and engagement: three different documents
The annual plan sits at the top. Each audit in it later gets its own scope and programme. If the terms are mixed up, the audit committee ends up approving test steps instead of priorities. Our guide to the audit programme covers the lower level. This post stays at the plan.
The inputs
A plan built only from last year's list repeats last year's blind spots. Gather five inputs first.
- The audit universe. Every process, unit, location and system that could be audited. See how to build an audit universe.
- A risk view. The company's risk register, if it has one, or a quick view built from interviews. See how to build a risk register.
- Board and audit committee asks. Areas they have worried about, past incidents and complaints.
- Regulatory calendar. Obligations that fall due in the year and sector rules that require review.
- Capacity. Auditor days after leave, training, holidays, follow-up and admin.
Worked example (all numbers invented)
Take a fictional mid-sized manufacturer, "Sample Components Ltd", with an internal audit team of three people.
Step 1: work out the days
Each person has 250 working days in the year in this example. Remove 30 for leave, 25 for training and admin, and 20 for follow-up and ad hoc requests. That leaves 175 usable days each.
- Three people at 175 days: 525 days.
- Hold back 15 percent, 79 days, as a reserve for management requests and fraud reviews.
- Days available to plan: 446.
Step 2: score the universe
Score each auditable area on impact and likelihood from 1 to 5, using a simple rule agreed with the committee. Multiply to get a risk score. Add a note where the area was last audited.
| Area | Impact | Likelihood | Score | Last audited | Decision |
|---|---|---|---|---|---|
| Procure to pay | 4 | 4 | 16 | 18 months ago | Audit, 60 days |
| Inventory and costing | 5 | 3 | 15 | 2 years ago | Audit, 70 days |
| Order to cash | 4 | 3 | 12 | 12 months ago | Audit, 45 days |
| Payroll | 3 | 3 | 9 | 14 months ago | Audit, 30 days |
| Fixed assets | 3 | 2 | 6 | 3 years ago | Audit, 25 days (age raises priority) |
| Statutory compliance | 4 | 3 | 12 | 12 months ago | Audit, 40 days |
| IT general controls | 4 | 3 | 12 | Never | Audit, 50 days |
| Plant 2 site review | 3 | 3 | 9 | Never | Audit, 40 days |
| Treasury | 3 | 2 | 6 | 2 years ago | Defer, review next year |
| HR policy compliance | 2 | 2 | 4 | 2 years ago | Defer |
The days in the table add up to 360. That leaves 86 days of the 446, which are kept for a follow-up of last year's open points (30 days), the audit committee pack and plan updates (25 days), and a flexible 31 days. The score is a guide, not an answer. Fixed assets scored only 6 but was last audited three years ago, so it went in.
Our related checklists for these cycles include procure to pay, order to cash, inventory and statutory compliance.
Step 3: sequence by quarter
Put audits where the business can support them, not just where the auditors are free.
- Q1 (April to June): Procure to pay, because the year-end creditor cleanup is behind the business and the processes are quiet.
- Q2 (July to September): Statutory compliance and IT general controls, ahead of half-year reporting.
- Q3 (October to December): Order to cash and Plant 2, before the year-end rush.
- Q4 (January to March): Inventory, timed around the year-end count where it adds value, and payroll.
Avoid scheduling the same process owners for two audits at once.
What goes in the plan document
- Objectives and how the plan links to the company's risks.
- The risk method in a short paragraph and the scoring table.
- Audits selected, with days, quarter, lead and the reason.
- Areas deferred and why, so the committee sees what is not covered.
- Resource summary: days available, days planned, reserve.
- Reporting rhythm, for example quarterly to the audit committee.
- A note on how changes will be approved.
The Board resolution that appoints the internal auditor is a separate step. See appointment of internal auditor for what the Audit Committee or Board settles on scope and periodicity.
Keep it living
Review the plan each quarter. Add an audit if a fraud allegation, a new system or an acquisition changes the risk. Drop or defer one when the days run out, and tell the committee. A plan that never changes is probably not tracking risk. A plan that changes without the committee's knowledge is not a plan.
Common mistakes
- Equal days for every area. Risk should decide the days.
- No reserve. Management requests will arrive.
- Too many audits. A plan of 25 thin audits produces 25 thin reports.
- Scoring in secret. Share the method so the committee can challenge it.
- Ignoring follow-up time. Closing last year's findings takes days too.
Frequently asked questions
What is an internal audit plan?
It is the yearly list of audits, with the reasons, days, timing and owners, approved by the audit committee or board.
Who approves the internal audit plan?
In most companies the audit committee or the board, depending on how the company has set up the function. Check the company's charter and, for listed entities, its governance policy.
How many audits should a plan include?
It depends on capacity. Plan to the days available after reserves, not to a target count.
Can the plan change during the year?
Yes, with the committee's knowledge. Record the reason for each change.
Is a risk score enough to choose audits?
No. Use it as a guide alongside time since the last audit, board concerns and regulatory dates.
Last reviewed: 17 October 2026. Facts checked. We opened our own site posts only; no ICAI or IIA standard text and no statute was opened. Example numbers are invented.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error