CORAA
Log inStart free trial

Internal Audit Annual Plan Template — Risk-Scored Audit Universe

The SIA 220 annual plan: a risk-scored audit universe (Impact × Likelihood, computed) mapped to a review calendar and assigned reviewer — the document the Audit Committee approves before the year's internal-audit cycle starts.

Free · CORAA original — SA-aligned
Updated 28 Jul 2026
Standard
SIA 220 — Conducting the Assignment
Computes
Risk score = Impact × Likelihood
Approved by
Audit Committee / Board
Format
Microsoft Word (.docx)
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

INTERNAL AUDIT ANNUAL PLAN

Entity: ___ · Period: ___ · Reports to: ___

Prepared per SIA 220 (Conducting the Assignment) — a risk-scored audit universe, ranked by Impact × Likelihood, mapped to a review calendar and an assigned reviewer. Higher-scored processes should be reviewed more frequently or earlier in the year; this plan is for Audit Committee / Board approval before the cycle begins.

Risk-Scored Audit Universe

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

How is the risk score computed and what does it mean?
Risk score is Impact (1 = low, 5 = critical) multiplied by Likelihood (1 = rare, 5 = almost certain), giving a score from 1 to 25 for each process in the audit universe. A higher score indicates the process should be reviewed sooner and more frequently within the annual cycle, not that it will automatically fail a review.
How is this different from the Internal Audit Risk Assessment Matrix template?
The Risk Assessment Matrix template is the standalone scoring exercise across the FULL audit universe used to derive priorities. This Annual Plan template takes that scoring a step further into an actual schedule — which quarter each process gets reviewed in and who is assigned to review it — the document typically taken to the Audit Committee for approval.
Does every process in the audit universe need to be reviewed every year?
No — SIA 220 expects the REVIEW FREQUENCY to be risk-based, not uniform. High-risk-score processes are typically reviewed annually or even more frequently; low-risk-score processes may sit on a 2-3 year rotation. The plan should make that rotation logic explicit rather than reviewing everything on the same cycle regardless of risk.
Related templates

You might also need.

Internal Audit Risk Assessment Matrix — Impact × Likelihood
Free internal audit risk assessment matrix template. Impact × Likelihood scoring computed automatically across
Internal Audit Charter Template — Section 138 / IIA / SIA
Free Internal Audit Charter template for Indian companies under Section 138 of the Companies Act 2013. IIA / I
Internal Audit Observation Format — SIA 360/370 Structure
Free internal audit observation format template. Condition, criteria, cause, effect, recommendation plus manag