An audit universe is the full list of areas, processes, locations and systems that internal audit could review. You build it by splitting the business into auditable pieces, rating each piece for risk, and using those ratings to pick what goes into the annual plan. It is a working list that you update, not a document you write once.
Last reviewed: 17 October 2026. Facts checked. We searched for how the IIA and ICAS describe the audit universe and the risk-based plan requirement. We did not open the IIA practice guide itself, and we cite no ICAI standard numbers.
What an audit universe is
Think of it as a map of the whole organisation, cut into pieces small enough to audit. Each piece is called an auditable entity. An entity can be a process (procure-to-pay), a location (the Pune plant), a function (HR), a system (the ERP) or a project.
The universe is not the audit plan. The plan is the short list you pick from the universe for this year.
One point that surprises many teams: the IIA's Standards do not make a written audit universe compulsory. What they do require is that the plan rests on a documented risk assessment, refreshed at least annually. In practice, a universe is the easiest way to show that your plan was chosen for a reason.
Step 1: Gather your sources
Start with what already exists. Do not build from a blank page.
- The organisation chart and the list of business units and locations.
- The chart of accounts and the trial balance, to see where the money sits.
- The risk register, if one exists.
- Last year's audit reports and open observations.
- Regulatory and legal obligations that apply to the business.
- The strategy and budget, to spot new projects, products and acquisitions.
Step 2: Break the business into auditable entities
Pick one way of slicing and stay with it. Mixing slicing methods causes gaps and double counting.
| Way of slicing | Good for | Watch out for |
|---|---|---|
| By process (order-to-cash, payroll) | Companies with shared processes across sites | Site-specific problems get missed |
| By location or unit | Branch networks, plants, hospitals | Shared processes get audited many times |
| By function (finance, HR, IT) | Small organisations | Entities become too big to audit in one go |
| Hybrid (process, tested at each location) | Mid-size and large groups | Needs clear naming rules |
A useful test: could a small team audit this entity in a few weeks? If not, split it. If it would take two days, merge it with a neighbour.
Step 3: Record facts about each entity
For every entity keep a short profile. This is what lets you score it fairly.
- Owner (who is accountable).
- Size: spend, revenue, headcount or transaction volume.
- Last audit date and the rating given.
- Open observations.
- Recent changes: new system, new manager, new rule.
- Regulatory exposure.
Step 4: Rate each entity for risk
Use a simple scale, such as high, medium and low, against a handful of factors. Keep the factors few so the team can apply them consistently.
| Factor | Question to ask |
|---|---|
| Financial size | How much money flows through it? |
| Complexity | How many steps, systems or hand-offs? |
| Change | Has anything changed recently? |
| Control strength | Did the last audit find weak controls? |
| Regulatory exposure | Does a regulator or law apply directly? |
| Fraud or error history | Have there been past incidents? |
Write down the scoring logic. If the audit committee asks why a process was left out, you can show the reasoning.
Step 5: Decide how often to audit each entity
Link the rating to a cycle. A common pattern is that high-risk entities are looked at every year, medium-risk entities every two years and low-risk entities every three years or on a rotation. Treat these as examples. Set your own cycles with your audit committee.
Step 6: Turn the universe into the annual plan
- Sort entities by risk score and time since last audit.
- Add areas the board or management has asked for.
- Leave time for unplanned requests and special reviews.
- Check capacity: hours available against hours needed.
- Show what you are not covering, and why.
Our internal audit annual plan generator and risk scorer can help you do the arithmetic.
Step 7: Keep it alive
Review the universe at least once a year, and again when something big changes, such as an acquisition, a new line of business or a new regulation. Add new entities, retire dead ones, and update the ratings with what you learned during the year.
Common mistakes
- Copying last year's list without checking what changed.
- Using too many risk factors, so scores become arbitrary.
- Making entities so large that "audited" tells you nothing.
- Never removing entities, so the universe grows until it cannot be covered.
- Scoring in a vacuum without talking to management.
Frequently Asked Questions
Is an audit universe mandatory?
Not under the IIA's Standards, which ask for a plan based on a documented risk assessment rather than a universe as such. Many teams still keep one because it makes the risk assessment easy to show. Check whether a regulator or your audit charter requires one for your sector.
How many entities should a universe have?
There is no right number. Make entities small enough to audit in a reasonable engagement and large enough to be meaningful. A mid-size company often ends up with a few dozen to a few hundred.
Who should own the audit universe?
The head of internal audit. Management should be consulted on risks and changes, but the audit team keeps the list so that it stays independent.
How is an audit universe different from a risk register?
A risk register lists risks. The audit universe lists places where you could audit. You link the two by asking which risks sit in which entity.
How often should we refresh it?
At least once a year, and whenever the business changes in a major way.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error