CORAA
Log inStart free trial

Internal Audit Risk Assessment Matrix — Impact × Likelihood

Score every process in the audit universe on Impact and Likelihood — the risk score is computed automatically — to rank what gets reviewed first and how often.

Free · CORAA original — SA-aligned
Updated 28 Jul 2026
Standard
SIA 220 — Conducting the Assignment
Computes
Risk score = Impact × Likelihood (1-25)
Slots
Up to 8 processes/entities
Format
Microsoft Word (.docx)
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

INTERNAL AUDIT UNIVERSE — RISK ASSESSMENT MATRIX

Entity: ___ · Period: ___

Per SIA 220 (Conducting the Assignment) — every process or auditable entity in scope is scored on Impact and Likelihood (1-5 each); the risk score (Impact × Likelihood, range 1-25) ranks the audit universe for planning purposes.

Risk-Scored Audit Universe

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

How should Impact be scored on a 1-5 scale?
Impact is usually scored against the entity's own materiality and strategic priorities — a common anchor is 1-2 = limited financial/operational effect if the risk materialises, 3 = moderate, single-process disruption, 4-5 = material financial misstatement, regulatory action, or reputational damage. The exact bands should be calibrated to the entity's size, not applied as a universal standard.
Is a risk score of 25 automatically a Material Weakness?
No — this is an audit-universe PRIORITISATION score (which process to review, and how often), not a finding-severity rating. A high risk score means the process deserves closer, more frequent review; whether an actual control deficiency found during that review rises to Material Weakness is a separate judgement made using the Deficiency / Significant Deficiency / Material Weakness scale on the specific finding.
What if two processes end up with the same risk score?
Tie-break on qualitative factors the numeric score doesn't fully capture — regulatory exposure, recent management turnover in that area, findings from the prior period, or fraud indicators specific to that process. The matrix is a starting rank, not a substitute for the auditor's own judgement in finalising the plan.
Related templates

You might also need.

Internal Audit Annual Plan Template — Risk-Scored Audit Universe
Free Internal Audit Annual Plan template. Risk-scored audit universe (impact × likelihood computed) with quart
Internal Audit Charter Template — Section 138 / IIA / SIA
Free Internal Audit Charter template for Indian companies under Section 138 of the Companies Act 2013. IIA / I
Fraud Risk Assessment (SA 240) — ICAI Audit Working Paper
Free fraud risk assessment (sa 240) audit working paper template (ICAI, Chapter 2). Generate with your firm le