Internal audit planning engine that builds risk-based audit universes, prioritizes engagements, designs control testing programs, and produces audit committee-ready reports. USE THIS SKILL when the user mentions internal audit plan, audit universe, control testing, audit program, audit committee reporting, audit risk assessment, sampling methodology, audit findings, issue tracking, or quality assurance and improvement program (QAIP). Covers the full audit lifecycle from planning through follow-up.
Internal audit planning engine that builds risk-based audit universes, prioritizes engagements, designs control testing programs, and produces audit committee-ready reports. USE THIS SKILL when the user mentions internal audit plan, audit universe, control testing, audit program, audit committee reporting, audit risk assessment, sampling methodology, audit findings, issue tracking, or quality assurance and improvement program (QAIP). Covers the full audit lifecycle from planning through follow-up.
Internal Audit Planning
Required Inputs
Organization: Company name, industry, and organizational structure.
Audit Period: Fiscal year or period covered by the audit plan.
Available Audit Resources: Number of auditors, total available audit days, budget.
Prior Audit Results: Previous findings, open issues, and management action plans.
Risk Assessment Output: Enterprise risk register or risk assessment (link to enterprise-risk-assessment skill if needed).
Regulatory Environment: Key regulations and compliance obligations.
Stakeholder Priorities: Board, audit committee, and management concerns.
Execution Steps
1. Define the Audit Universe
Map every auditable entity in the organization. The audit universe is exhaustive -- nothing is excluded without documented justification.
Audit Universe Categories
Category
Examples
Typical Entities
Business Units
Divisions, subsidiaries, regions
5-50 per organization
Core Processes
Revenue cycle, procurement, payroll, treasury
8-15 standard processes
IT Systems
ERP, CRM, cloud platforms, custom applications
10-30+ systems
Compliance Programs
SOX, data privacy, anti-corruption, AML
3-10 programs
Third Parties
Key vendors, outsourced functions, JV partners
5-20 critical relationships
Projects & Initiatives
Major transformations, M&A integration, system implementations
Score each auditable entity on weighted risk factors to determine audit priority.
Risk Factor Scoring Model
Risk Factor
Weight
Score 1 (Low)
Score 3 (Medium)
Score 5 (High)
Financial Impact
20%
<$1M revenue/assets
$1M-$50M
>$50M
Regulatory Exposure
20%
Minimal regulatory oversight
Moderate regulation
Heavy regulation, recent enforcement
Operational Complexity
15%
Simple, stable process
Moderate complexity
Highly complex, many handoffs
Change Velocity
15%
No significant changes
Moderate changes (new system, reorg)
Major transformation underway
Prior Audit Results
15%
Clean, no issues
Minor findings
Significant findings or repeat issues
Time Since Last Audit
10%
<12 months
12-24 months
>24 months or never audited
Management Concern
5%
No concerns raised
Some concerns
Specific request from board/management
Composite Risk Score Calculation
Composite Score = SUM(Factor Weight x Factor Score)
Range: 1.00 (lowest risk) to 5.00 (highest risk)
Priority Classification
Priority
Composite Score
Audit Frequency
Resource Allocation
Mandatory
N/A (regulatory)
Annual
As required
Priority 1
4.01 - 5.00
Annual
Full-scope audit
Priority 2
3.01 - 4.00
Annual or biennial
Full or targeted audit
Priority 3
2.01 - 3.00
Biennial or triennial
Targeted or limited review
Priority 4
1.00 - 2.00
Triennial or risk-monitored
Continuous monitoring only
3. Annual Audit Plan Construction
Translate prioritized entities into a resourced, scheduled audit plan.
Resource Allocation Formula
Available Audit Days = (Number of Auditors x Working Days) - Training - Admin - Carry-forward
Typical: 1 auditor = 220 working days - 20 training - 30 admin = 170 available audit days
Engagement Effort Estimates
Engagement Type
Typical Duration (Days)
Team Size
Total Effort
Full-scope audit
15-30
2-3
30-90 days
Targeted/focused audit
8-15
1-2
8-30 days
Follow-up review
3-5
1
3-5 days
Continuous monitoring
Ongoing
0.5 FTE
85 days/year
Advisory/consulting
5-15
1-2
5-30 days
Investigation
Variable
2-3
20-60 days
Annual Audit Plan Template
Engagement ID
Entity
Type
Objective
Q1
Q2
Q3
Q4
Lead Auditor
Est. Days
Priority
IA-2025-001
[Entity]
Full-scope
[Objective]
X
[Name/Role]
[Days]
P1
IA-2025-002
[Entity]
Targeted
[Objective]
X
[Name/Role]
[Days]
P1
Plan Coverage Analysis
Audit Universe Coverage = Entities Planned for Audit / Total Entities in Universe
Target: 100% coverage within a 3-year rolling cycle
Annual coverage target: 33-50% of audit universe
4. Audit Scope and Objectives Framework
For each engagement, define scope, objectives, and approach before fieldwork begins.
Engagement Planning Memo Template
Element
Detail
Engagement Title
[Descriptive title]
Auditable Entity
[From audit universe]
Audit Objective
[What the audit will assess -- controls, compliance, efficiency]
Scope Period
[Transaction period under review]
Scope Boundaries
[In scope / out of scope]
Key Risks
[Top 3-5 risks from risk assessment]
Audit Criteria
[Standards, policies, regulations against which to assess]
Methodology
[Interviews, walkthroughs, sample testing, data analytics]
Timeline
[Fieldwork start/end, draft report, final report]
Team
[Lead, staff, specialists]
Budget
[Planned hours/days]
5. Control Testing Methodology
Test controls for both design effectiveness and operating effectiveness.
Phase A: Design Effectiveness (Does the control address the risk?)
Test
Question
Evidence
Control objective alignment
Does the control directly mitigate the identified risk?
Policy, procedure documentation
Completeness
Are all key risk scenarios addressed by at least one control?
Control-risk matrix
Authority and segregation
Are appropriate approvals and segregation of duties in place?
Org chart, access matrix
Timeliness
Is the control performed at the right frequency?
Procedure documentation
Information quality
Does the control use reliable, complete information?
Data source analysis
Phase B: Operating Effectiveness (Is the control working as designed?)
Test Type
When to Use
Example
Inquiry
Always (but never alone)
Interview the control operator about how they perform the control
Observation
Real-time processes
Watch a supervisor review and approve journal entries
Inspection
Document-based controls
Examine signed approvals on purchase orders
Reperformance
Calculated/automated controls
Independently recalculate a reconciliation
Data analytics
High-volume transactions
Run full-population analysis on payment data
Control Conclusion Matrix
Design Effective?
Operating Effective?
Overall Conclusion
Yes
Yes
Effective -- rely on control
Yes
No
Operating deficiency -- finding required
No
Not tested
Design deficiency -- finding required
No
N/A
Material weakness candidate
6. Sampling Methodology
Sample Size Guidance (Attribute Testing)
Population Size
Expected Deviation Rate 0%
Expected Deviation Rate 1-2%
Expected Deviation Rate 3-5%
< 50
Test all
Test all
Test all
50-100
25-30
30-40
40-50
101-500
25-30
30-45
45-60
501-2,000
25-30
35-50
50-60
2,001-10,000
25-30
40-55
55-60
> 10,000
25-30
45-60
58-60
Sampling Method Selection
Method
When to Use
Random
Standard attribute testing, unbiased population
Stratified
Population has distinct subgroups (e.g., by dollar amount or location)
Haphazard
Quick directional testing only, not for formal conclusions
Preferred when feasible -- eliminates sampling risk entirely
7. Audit Finding Severity Classification
Align with the practice risk rating scale but add audit-specific context.
Severity
Definition
Management Response Timeline
Escalation
Critical
Control failure that has resulted in or could imminently result in material financial loss, regulatory sanction, or safety incident. Immediate executive and audit committee notification required.
Immediate action plan; remediation within 30 days
Audit Committee, CEO
High
Significant control deficiency with high likelihood of material impact if not remediated. No compensating controls in place.
Action plan within 5 business days; remediation within 60 days
CAE, CFO, relevant C-suite
Medium
Moderate control weakness. Compensating controls partially mitigate risk. Repeat finding elevates to High.
Action plan within 10 business days; remediation within 90 days
CAE, business unit head
Low
Minor control improvement opportunity. Unlikely to result in material impact. Best practice recommendation.
Addressed in normal course; remediation within 180 days
Audit management, process owner
Advisory
Observation or efficiency recommendation. Not a control deficiency.
Optional
Process owner
8. Reporting Templates
Individual Audit Report Structure
## Internal Audit Report: [Engagement Title]### Report ID: [IA-YYYY-NNN]
| Field | Detail |
|---|---|
| Entity Audited | [Name] |
| Audit Period | [Start - End] |
| Report Date | [Date] |
| Overall Rating | [Satisfactory / Needs Improvement / Unsatisfactory] |
| Lead Auditor | [Name] |
| Distribution | [Names and roles] |
### Executive Summary
[2-3 paragraph summary: scope, key findings, overall opinion]
### Overall Opinion
[Satisfactory / Needs Improvement / Unsatisfactory] with basis for opinion.
### Scope and Methodology- Objectives: [What we assessed]
- Period: [Transaction dates reviewed]
- Methodology: [Testing approach]
- Limitations: [Any scope restrictions]
### Findings and Recommendations#### Finding 1: [Title]
| Attribute | Detail |
|---|---|
| Severity | [Critical/High/Medium/Low] |
| Condition | [What we found] |
| Criteria | [What should be] |
| Cause | [Why the gap exists] |
| Effect | [Actual or potential impact] |
| Recommendation | [What to do] |
| Management Response | [Agree/Disagree + action plan] |
| Target Date | [Remediation deadline] |
| Responsible Owner | [Name and role] |
### Appendices- A: Detailed test results
- B: Population and sample details
- C: Documents reviewed
Quarterly Audit Committee Summary
## Internal Audit Quarterly Report to Audit Committee### Period: [Q# FY####]### Plan Execution Status
| Metric | Target | Actual | Variance |
|---|---|---|---|
| Audits completed | [#] | [#] | [+/-] |
| Audit days used | [#] | [#] | [+/-] |
| Plan completion (YTD) | [%] | [%] | [+/-] |
### Completed Audits This Quarter
| Engagement | Rating | Critical | High | Medium | Low |
|---|---|---|---|---|---|
| [Name] | [Rating] | [#] | [#] | [#] | [#] |
### Open Findings Aging
| Aging Bucket | Critical | High | Medium | Low | Total |
|---|---|---|---|---|---|
| Current (within target date) | [#] | [#] | [#] | [#] | [#] |
| Overdue 0-30 days | [#] | [#] | [#] | [#] | [#] |
| Overdue 31-90 days | [#] | [#] | [#] | [#] | [#] |
| Overdue > 90 days | [#] | [#] | [#] | [#] | [#] |
### Key Themes and Emerging Risks
[Narrative on patterns across audits, new risks identified]
### Plan Amendments
[Any changes to the annual plan with rationale]
### Resource and Budget Update
[Staffing, co-source usage, budget status]
