Internal Audit Plan Under Standard 9.4: Annual Risk Assessment, Contingency Hours and Board Approval

Standard 9.4 of the IIA Global Internal Audit Standards is the shortest path to a defensible internal audit plan. Its requirements are specific enough to turn into a checklist, and its implementation guidance describes what a board-ready plan contains. This post walks through both and builds a worked plan for a mid-sized company.

What the standard requires

The chief audit executive must create a plan that supports the organization's objectives. The plan must rest on a documented assessment of the organization's strategies, objectives and risks. That assessment must be informed by input from the board and senior management as well as the chief audit executive's understanding of governance, risk management and control processes, and it must be performed at least annually.

The plan itself must do five things:

1. Consider the internal audit mandate and the full range of agreed-to services.
2. Specify services that support evaluation and improvement of governance, risk management and control processes.
3. Consider coverage of information technology governance, fraud risk, the effectiveness of compliance and ethics programs, and other high-risk areas.
4. Identify the human, financial and technological resources needed.
5. Be dynamic and updated timely in response to changes in the organization's business, risks, operations, programs, systems, controls and culture.

Three communication duties follow. The chief audit executive must tell the board and senior management, on a timely basis, about the effect of resource limits on coverage, the rationale for leaving a high-risk area out of the plan, conflicting demands between stakeholders, and any limits on scope or access. The chief audit executive must discuss the plan and significant interim changes with the board and senior management. The board must approve the plan and significant changes.

What a proposed plan should show

The implementation text of the standard lists what the proposed plan should include (these are considerations, not requirements). Treat it as the table of contents:

• Resources and hours available for engagements compared with administrative and improvement activities.
• The list of proposed engagements, marked as assurance or advisory, by department or objective, and by whether they address financial, compliance, operational, cybersecurity or other objectives.
• The rationale for selecting each one, such as significance of risk, a theme or trend (root cause), a regulatory requirement, or time since the last engagement.
• The general purpose and preliminary scope of each.
• A percentage of hours reserved for contingencies and ad hoc requests.
• The next set of engagements that would have been done if more resources were available. The standard says discussing these helps the board assess whether resources are adequate.

The "next in line" list is a practical way to use that item. It converts a resource complaint into a board decision with named engagements attached.

Worked example

In this hypothetical, a company with $140 million of revenue has a two-person internal audit function and a co-source arrangement with a CPA firm. Available hours for the year:

The planned engagements:

Next in line, if hours were added: fixed asset additions testing (300 hours) and treasury (340 hours). The chief audit executive brings both lists to the audit committee, with the reasons the fixed asset and treasury work is not in the base plan. If the committee wants them, it can fund them or swap them for a planned engagement, and the minutes record the decision. That is the evidence of conformance the standard lists: the approved plan, the documented risk assessment and prioritization, and minutes of the discussion.

Keeping the plan alive

The standard says the plan must be dynamic. The implementation text says that in a dynamic environment the plan may need to be updated as frequently as every six months, quarterly or even monthly, and that the chief audit executive, the board and senior management should agree on the criteria that define a significant change requiring a revision. Canceling or postponing an engagement tied to a significant risk is one of the examples given. If risks arise that need a revision before a formal board meeting, the implementation text says the board should be informed immediately and formal approval should occur as soon as possible.

Build that protocol into the charter or the plan document: name the triggers (acquisition, system conversion, restatement, loss of a key finance leader), name the person who informs the audit committee chair, and name the timeframe.

Common gaps

• A risk assessment that exists only as a spreadsheet with no input from the board or senior management.
• No documented reason for omitting a high-risk area.
• No contingency hours, so every ad hoc request displaces a planned engagement silently.
• Plan approved once and never revisited after a system conversion.

For how the plan connects to a universe of auditable units, see /us/blog/audit-universe-how-to-build-one-for-internal-audit. For the broader function, see /us/blog/internal-audit-guide-plan-charter-report-program.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standard 9.4 Internal Audit Plan, including Requirements, Considerations for Implementation and Examples of Evidence of Conformance: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error