Internal and Forensic Audit · Practices related to Internal Auditing

Internal Audit Planning and Risk Assessment Explained

Updated 11 October 2026 · Fact-checked

Internal audit planning means listing every auditable area (the audit universe), scoring each for risk, ranking them, and choosing what to audit in the year within available time and people. The annual plan is approved by the audit committee or management. Each engagement then gets its own detailed plan.

Understand Internal Audit Planning and Risk Assessment

An entity has many processes, units and systems. An internal auditor cannot cover all of them every year. Planning decides what to audit, when, how deeply and with whom.

The starting point is the audit universe. It is the full list of auditable entities: processes, functions, locations, subsidiaries, systems and compliance areas. You build it from the organisation chart, the risk register, past audit reports, process maps, management inputs and regulatory requirements. Keep it updated when the business changes.

Next comes risk assessment. For each item in the universe you judge the inherent risk (risk before controls) and the strength of controls. Common factors are financial size, complexity, volume of transactions, regulatory exposure, fraud history, change in people or systems, and time since the last audit. You rate each factor, often as high, medium or low, or on a numeric scale, and combine them into a risk score. This is a risk-based internal audit approach: high-risk areas get more frequent and deeper audits.

The annual (or periodic) audit plan is built from the ranked universe. High-risk areas are covered every year, medium-risk areas every two or three years, low-risk areas on a longer cycle or on request. The plan is limited by resources, so you compare the audit hours needed with the hours available and keep some buffer for special assignments. The plan is shared with management and approved by the audit committee or those charged with governance. It can be revised when risks change.

Then each engagement gets its own plan. It sets objectives, scope, timing, team, budget, and the audit programme. The engagement plan is based on a focused risk assessment of that specific area, so that testing goes where the risk is.

Key rules to remember

Risk score (common scoring model): Risk score = Impact × Likelihood; Used with a 1-5 scale in many organisations. It is a method, not a legal formula. State the scale you use. Some models also adjust for control effectiveness.
Residual risk (conceptual): Residual risk = Inherent risk − Effect of controls; Conceptual, not literal subtraction. Weak controls leave residual risk close to inherent risk.
Weighted risk score: Weighted score = Σ (factor rating × factor weight); Weights should total 100% so scores are comparable across auditable units.
Resource availability: Available audit hours = Number of auditors × Working days × Hours per day − Leave, training and admin time; Compare this with the total hours needed for the planned engagements. Keep a contingency for unplanned work.
Audit cycle rule of thumb: High risk: annual; Medium risk: every 2-3 years; Low risk: longer cycle or on request; This is a common practice, not a mandatory rule. The audit committee can set different cycles.

How to solve Internal Audit Planning and Risk Assessment questions

Use this order for any question on planning, risk assessment or the audit plan. It keeps your answer structured as provision or principle, application and conclusion.

1Identify what is asked: audit universe, risk assessment, annual plan, engagement plan or resource allocation.
2Define the key term in one line, for example audit universe or inherent risk.
3List the inputs: risk register, past reports, process maps, management and audit committee concerns, regulatory requirements.
4Apply risk factors to the facts given. Rate each area as high, medium or low, or compute a score and rank them.
5Link ranking to coverage: frequency, depth of testing and sequence of audits.
6Check resources against the plan: hours available, skills needed, buffer. Drop or defer low-risk items if needed.
7Mention approval by the audit committee or management, communication to auditees and revision when risks change.
8Conclude with a clear recommendation or plan on the facts given.

Quickest way: Rank, fit, approve

When to use it: Use when time is short, for example a 5-6 mark question or a numerical ranking question.

Write one line defining the audit universe and risk-based planning.
Rank areas by risk score (Impact × Likelihood) or by stated factors.
Fit the ranked areas into available hours, highest risk first.
State what is deferred and why.
Close with approval by the audit committee and periodic review.

Common mistakes in Internal Audit Planning and Risk Assessment

Treating the audit universe as only the financial accounting areas.
Students link internal audit with statutory audit.
Fix: Include operations, compliance, IT, locations and subsidiaries. Internal audit covers all areas where risk exists.
Planning audits by rotation or equal time for every area.
It looks fair and is easy to schedule.
Fix: Allocate frequency and depth by risk. Equal coverage wastes effort on low-risk areas.
Confusing inherent risk with residual risk.
Both terms sound alike.
Fix: Inherent risk is before controls. Residual risk is what remains after controls. Say which one you use for ranking.
Ignoring resource limits when drafting the annual plan.
Students list all high-risk areas without checking hours.
Fix: Always compare required hours with available hours, keep a buffer and explain deferrals.
Treating the annual plan as fixed once approved.
Plans seem like formal documents that cannot change.
Fix: State that the plan is revised for new risks, acquisitions, frauds or management requests, with approval for changes.
Mixing up the annual plan with the engagement plan.
Both are called audit plans.
Fix: The annual plan decides which areas to audit. The engagement plan sets objectives, scope, team, timing and programme for one audit.

Worked examples

Example 1

An internal auditor rates four areas on Impact and Likelihood (scale 1-5): Procurement (4, 4), Payroll (3, 2), IT access controls (5, 3), Petty cash (1, 3). Rank them using Risk score = Impact × Likelihood and state the audit priority.

Show the solution

Procurement: 4 × 4 = 16.
Payroll: 3 × 2 = 6.
IT access controls: 5 × 3 = 15.
Petty cash: 1 × 3 = 3.
Rank from highest: Procurement 16, IT access controls 15, Payroll 6, Petty cash 3.
Procurement and IT access are the top priorities for the current year. Payroll can be a medium-cycle audit. Petty cash is low risk and can be covered on a longer cycle.

Answer: Ranking: Procurement (16), IT access controls (15), Payroll (6), Petty cash (3). Audit the first two this year with deeper testing, payroll in a later cycle and petty cash on a long cycle.

Example 2

An internal audit team has 4 auditors. Each works 220 days a year at 8 hours a day. Each loses 300 hours a year to leave, training and admin work. The proposed plan needs 6,200 hours. Is the plan feasible? What should the head of internal audit do?

Show the solution

Gross hours per auditor = 220 × 8 = 1,760.
Net hours per auditor = 1,760 − 300 = 1,460.
Total for 4 auditors = 1,460 × 4 = 5,840 hours.
Required hours are 6,200. Shortfall = 6,200 − 5,840 = 360 hours.
The plan is not feasible as drafted, and no buffer exists for special assignments.
Options: defer or reduce scope of low-risk engagements, use a co-sourced specialist, or ask the audit committee for more resources.
Any change should be reported to the audit committee for approval.

Answer: Available hours are 5,840 against 6,200 needed, a shortfall of 360 hours. The head should defer low-risk audits or add resources, and get the audit committee's approval for the revised plan.

Exam tips

Write answers in the order: definition, inputs, risk assessment, plan, resources, approval. It earns marks for structure.
If a question gives numbers, show the calculation line by line and state the ranking in words.
Use the facts in the case. Name the actual area, such as procurement or payroll, and say why its risk is high or low.
Mention the audit committee's role in approving the plan. Examiners look for the governance link.
For drafting questions, set out the audit plan as a short table-like list in text: area, risk rating, frequency, hours, timing.

Practice questions from Practices related to Internal Auditing

Internal Audit Planning and Risk Assessment in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Planning and Risk Assessment: frequently asked questions

What is an audit universe?

It is the complete list of auditable areas in an organisation, such as processes, functions, locations, systems and compliance areas. The auditor ranks it by risk to decide what to audit.

What is the difference between an annual audit plan and an engagement plan?

The annual plan selects which areas will be audited in the year, with timing and resources. The engagement plan covers one audit: objectives, scope, team, budget and audit programme.

Who approves the internal audit plan?

The audit committee or those charged with governance normally approves it, after discussion with management. Any major change during the year should also be approved by them.

How often should high-risk areas be audited?

Many organisations audit high-risk areas every year, but this is practice and not a fixed legal rule. The cycle is set by the risk assessment and approved by the audit committee.