Internal Audit Planning & Risk Based Assurance
Executive Summary
An organisation without an existing Internal Audit function sought to establish a three-year, risk-based Internal Audit Plan to support an outsourced assurance model. The engagement focused on developing a strategic assurance programme by aligning future audit activities with organisational objectives, enterprise risks, ensuring assurance resources were focused on the areas of greatest organisational significance.
Challenge
Without an existing Internal Audit function, the organisation required a structured and risk-based approach to determining where independent assurance would deliver the greatest value. Before a three-year Internal Audit Plan could be developed, it was necessary to understand the organisation's strategic objectives, enterprise risks, existing assurance activities and cyclical review requirements to identify where assurance already existed and where gaps remained.
The objective extended beyond developing a three-year Internal Audit Plan. It was to establish a strategic assurance programme that aligned future Internal Audit activities with organisational priorities, ensuring independent assurance was focused on the areas of greatest significance while avoiding unnecessary duplication of existing assurance activities.
Approach
Rather than focusing solely on developing a three-year Internal Audit Plan, the engagement centred on establishing a strategic, risk-based assurance programme aligned to the organisation's objectives, risks and existing assurance activities. Strategic priorities, existing assurance coverage and emerging organisational risks were considered to ensure future Internal Audit activities remained relevant, proportionate and focused on the areas of greatest organisational significance.
Throughout the engagement, the emphasis remained on creating an Internal Audit Plan that could evolve alongside the organisation rather than becoming a fixed programme that quickly became outdated. The objective was to establish a practical and forward-looking assurance programme that would provide meaningful insight to Executive Management and the Audit & Risk Committee, strengthen confidence in key processes and controls, and remain responsive as organisational priorities and risks changed.
Deliverable
The key deliverables from this engagement included establishing the following Internal Audit planning components:
| Component | Evolution | Business Benefit |
|---|---|---|
| Three-Year Internal Audit Plan | Developed a strategic, risk-based audit programme aligned to organisational objectives and enterprise risks. | Assurance resources focused on the areas of greatest organisational significance. |
| Strategic Alignment | Reviewed organisational objectives, enterprise risks and existing risk ratings to inform audit planning. | Internal Audit activities aligned with the organisation's strategic priorities and risk profile. |
| Assurance Mapping | Assessed existing sources of assurance to identify coverage, duplication and opportunities for independent assurance. | More coordinated assurance with reduced duplication and improved organisational oversight. |
| Audit Prioritisation | Balanced strategic, operational and cyclical assurance requirements across the planning horizon. | Practical and proportionate audit programme capable of evolving as organisational risks changed. |
| Audit & Risk Committee Reporting | Developed supporting documentation outlining the planning methodology, priorities and rationale. | Greater transparency and confidence in how future Internal Audit activities were selected. |
Outcome
The three-year Internal Audit Plan provided a structured, risk-based foundation for future assurance activities across the organisation. By aligning audit priorities with organisational objectives, enterprise risks and existing assurance activities, the plan ensured independent assurance was focused on the areas of greatest organisational significance while providing a practical roadmap for future assurance delivery.
The engagement also reinforced Internal Audit as a strategic source of independent assurance rather than simply a compliance function. By aligning assurance activities with organisational priorities and emerging risks, the resulting programme provided a practical foundation capable of adapting as the organisation evolved.