Building the risk-based internal audit plan under Standard 9.4

• Build an audit universe and score it against the organization’s objectives and risks
• Apply the Standard 9.4 content requirements to a draft plan
• Decide how SOX testing fits within the internal audit plan
• Communicate resource limits and excluded high-risk areas to the board

What Standard 9.4 requires

Standard 9.4 requires the chief audit executive (CAE) to create an internal audit plan that supports the achievement of the organization’s objectives. The plan must rest on a documented assessment of the organization’s strategies, objectives and risks, informed by input from the board and senior management and by the CAE’s understanding of governance, risk management and control processes. The assessment must be performed at least annually.

The plan itself must:

• consider the internal audit mandate and the full range of agreed services;
• specify services that support evaluation and improvement of governance, risk management and control;
• consider coverage of IT governance, fraud risk, the effectiveness of compliance and ethics programs, and other high-risk areas;
• identify the human, financial and technological resources needed;
• be dynamic and updated timely for changes in the business, risks, systems, controls and culture.

The CAE must communicate timely to the board and senior management the impact of any resource limitations on coverage, the rationale for not including an assurance engagement in a high-risk area, conflicting demands for services, and limits on scope or access to information.

Step 1: the audit universe

List auditable units: business units, processes, locations, systems, legal entities, programs and projects. Link each unit to the strategic objectives it supports and the risks in the enterprise risk register. A universe that does not tie to objectives fails the first sentence of Standard 9.4.

Step 2: score the risk

A weighted model works well. One common design scores impact and likelihood on a 1 to 5 scale and adds factors for change, complexity, time since last audit, and results of prior work. The weights are methodology, not standard: document them under Standard 9.3 and apply them consistently. Take input from the board and senior management through interviews or a survey, and record it, because the input requirement is something an external assessor will look for.

Step 3: place SOX in the plan

SOX testing is often the largest single block of hours. Decide and document:

• whether internal audit performs management’s testing, supports it, or only coordinates;
• the hours reserved for SOX and the hours left for risk-based assurance;
• which risks SOX covers well (financial reporting) and which it does not (operations, cybersecurity beyond the financial systems, compliance, culture).

If SOX consumes most of the capacity, the plan will leave high-risk areas uncovered. That is a resource limitation the CAE must report to the board under Standard 9.4.

Step 4: coordinate and rely

Standard 9.5 requires the CAE to coordinate with internal and external assurance providers and consider relying on their work. Coordination minimizes duplication and highlights gaps. When internal audit relies on another provider, the CAE documents the basis for reliance and remains responsible for internal audit’s conclusions. Coordination with the external auditor runs both ways: AS 2201.B12 lets the external auditor take internal audit’s planned location work into account when deciding where to test.

Step 5: approve and keep it current

Standard 9.4 requires that the board approve the plan and significant changes to it, and Standard 8.1 requires the CAE to report the plan, budget and significant revisions to the board and senior management. Build a quarterly refresh into the calendar: re-score units affected by acquisitions, new systems, regulatory change or incidents, and take changes to the audit committee. A plan approved in January and never touched fails the "dynamic" requirement.

Common weaknesses

• The risk assessment is undocumented or copied from last year.
• IT governance, fraud and compliance programs are missing with no explanation.
• The plan lists audits but not the resources needed to complete them.
• High-risk units dropped for capacity reasons are not reported to the board.

Scoring and cutting the 2027 plan at Northgate Components, Inc.