What it is
An audit universe lists everything internal audit could review. Scoring it on weighted risk criteria shows where to spend limited hours and how often each area should be reviewed. This workbook scores up to 40 entities on seven criteria, rates and ranks them, and sets the cycle.
Weights, thresholds and cycles are your own. The sheet checks that the weights total 100%, accepts an override with a written reason and feeds the annual plan.
When to use it
- At the start of annual planning.
- When a change (an acquisition, a new system) alters the risk of an area.
- To explain to the audit committee why an area is, or is not, on the plan.
What’s inside
- Criteria tab with weights, thresholds and cycles by rating
- Universe tab with 1 to 5 scores, weighted score, rating, override, rank, cycle and next due date
- Checks on weights and unexplained overrides
Standard cited
This template follows IIA Global Internal Audit Standards (2024). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Which criteria should I use?
Whatever predicts where an audit would find something that matters. The sample set covers financial significance, complexity, change, strength of the control environment, regulatory exposure, fraud susceptibility and time since the last audit. Replace or reweight them to suit the entity.
Can I override the rating?
Yes, when judgment says the score misses something such as a recent incident or a board request. The sheet asks for the reason so the override can be defended later.
Related templates
- Internal Audit Annual Plan Workbook
- Risk Heat Map: Likelihood and Impact
- Risk Register
- Internal Audit Charter
Last updated 11/05/2026. All free templates.