How to Build an Audit Universe for Internal Audit: Auditable Units, Risk Links and Coverage Map

An audit universe is the list of everything internal audit could audit. The IIA Global Internal Audit Standards do not require one by that name, but the implementation text for Standard 9.4 describes it as one approach to preparing the plan, and it gives enough detail to build one properly. This post follows that text and adds a worked example.

What the standards say

Standard 9.4's implementation section says one approach to preparing the plan is to organize potentially auditable units into an audit universe to help identify and assess risks. The universe is most useful when it is based on an understanding of the organization's objectives and strategic initiatives and aligned with the organization's structure or risk framework. Auditable units may include business units, processes, programs and systems. The chief audit executive can link those units to key risks to prepare a comprehensive risk assessment and identify assurance coverage across the organization.

Standard 9.1 requires the chief audit executive to understand the organization's governance, risk management and control processes before building the strategy and plan. The key risk areas the CAE must understand include the reliability and integrity of financial and operational information, effectiveness and efficiency of operations and programs, safeguarding of assets, and compliance with laws and regulations.

Two cautions from Standard 9.4 shape the build. First, the function should independently review and validate the key risks identified in the organization's risk management system, and should rely on management's information about risks only if it has concluded that the risk management processes are effective. Second, the CAE should give due consideration to risks such as ethics, fraud, information technology, third-party relationships and regulatory noncompliance that can tie to more than one business unit or process and may need a more complex evaluation.

Step 1: Define auditable units

Combine three views.

• Organization view. Legal entities, divisions, locations, shared service centers.
• Process view. Procure to pay, order to cash, hire to retire, record to report, treasury, inventory, fixed assets, tax.
• System view. ERP, payroll platform, banking portals, data warehouse, key spreadsheets.

Keep each unit small enough to audit in one engagement of a few hundred hours.

Step 2: Link units to objectives and risks

For each unit record the objective it supports, the key risks (including fraud, IT, third-party and compliance), the existing controls and who owns them, and the assurance coverage already provided by others (external audit, SOX testing, regulators, second line). Standard 9.5 asks the CAE to coordinate with other assurance providers and consider relying on their work, so the coverage column reduces duplication.

Step 3: Validate

Interview the board's audit committee chair, the chief executive, the chief financial officer and a sample of process owners. Compare their risk views with the enterprise risk register. Where the register is missing or stale, say so in the risk assessment and do your own.

Step 4: Score and rank

Use a simple scale for inherent risk (impact and likelihood), control effectiveness as last assessed, and time since last review. The standards leave the method to the function. The implementation text for 9.4 gives significance of risk, organizational theme or trend (root cause), regulatory requirement and time since last engagement as examples of the rationale for selecting an engagement, so include those fields.

Worked example

A hypothetical company with $160 million of revenue, three locations and one ERP.

Sorting by inherent risk and time since last review puts payroll (never audited), then the ERP and order to cash (3 years each), then procure to pay at the top of the ranking. That ranking feeds the hours budget in the annual plan. See /us/blog/internal-audit-plan-standard-9-4-annual-risk-assessment-and-board-approval.

Step 5: Keep it current

Standard 9.4 requires the risk assessment at least annually and a plan that is dynamic, updated timely when the business, risks, operations, programs, systems, controls or culture change. The implementation text says that in a dynamic environment the plan may need updating as frequently as every six months, quarterly or even monthly. Treat the universe as a living register: add units after acquisitions or system conversions, retire units when processes are outsourced, and update the "last audit" column after every engagement.

Common errors

• Building the universe from the org chart only, which misses cross-cutting risks like fraud or IT.
• Copying the enterprise risk register without validating it.
• No column for other assurance, which causes duplicate coverage.
• Never retiring units, so the universe balloons beyond what the function could ever cover.

Related reading

• /us/blog/risk-register-scoring-likelihood-impact-and-residual-risk
• /us/blog/risk-and-control-matrix-guide

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 9.1, 9.4, 9.5: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error