Challenges Faced in Developing Audit Plans and Programs 21 st March, 2013

Challenges Faced in Developing

Audit Plans and Programs

21st March, 2013

Two Key Internal Audit Planning Aspects:

Challenges Faced in Developing Audit Plans and Programs

• The Preparation of the Annual Audit Plan• The Drafting of Audit Programs

What is the Annual Audit Plan?


Why is it so important?

The Internal Audit Plan is a strategic document that helps to enable the Internal Audit Activity to achieve its vision and mission. The Practice Guide (Developing the Internal Audit Strategic Plan) discusses critical steps necessary to develop a comprehensive internal audit strategic plan including:



• Understanding the relevant industry and the organisation’s objectives;

• Consider the IPPF Standards and Guidance;• Understand Stakeholder Expectations;• Update the Internal Audit Vision and Mission;• Define the critical success factors;• Perform a SWOT Analysis;• Identify key initiatives.

The annual Audit Plan is a report of scheduled audits that is developed each year based on results from the audit universe risk assessment. The audit universe is a list of auditable processes, functions and units within the organisation.


Under normal circumstances the annual audit plan is performed upon completion of the Risk Assessment Phase. It is driven by two key factors:


1. Risk Assessment Results2. Internal Audit Resources

The goal is to address the highest risk areas given the resources available.


The risk assessment of the audit universe takes into account:


• Internal concerns communicated by management and staff throughout the year;

• Audit Department factors such as the risks that were discovered while conducting audits but not included in the review because they were outside the audit scope.

• Audits that were planned for the current year but were not completed due to time or staffing;

• The last date the unit, function or process was audited;

• Concerns communicated by external auditors during the external audit activities.

Most CAE’s face challenges each year while preparing and drafting the Annual Audit Plan. This should address the needs of an organisation and should be designed to provide the most effective and efficient deployment of Internal Audit Resources to meet those needs.


The Audit Plan needs to be aligned to the Company Strategy and to the key business risks which the auditor needs to understand.

It has to be aligned to the Company’s needs and expectations.


The most important element of the planning and scoping process is to ensure that there is sufficient coverage of the audit universe and that no material items are missed.


In planning the Audit Plan the Internal Auditor needs to focus on the business risks and needs to consult with the Business Unit Managers to identify the inherent business risk areas.


Traditional audit plans are often driven by the overall inherent levels of risk exposure without considering the perceived level of internal control. This could lead to audit findings highlighting issues which management are already aware of and as a result Internal Audit is perceived as a non-value adding activity.


Leading Internal Audit functions consider internal control maturity when determining an appropriate response for the significant risks to the business.



Improve Audit

AcceptMonitor

Internal Control Maturity

Ris

k L

evel

Im

pac

t /

Pro

bab

ilit

y

Some CAEs question why they should plan a year in advance when the business environment significantly changes. The issue of continuous change may be addressed through a rolling audit planning process. The audit plan is updated on an ongoing basis and audits are scheduled on a rolling 6 + 6 months basis with room for ad hoc projects and business requests.


The key customers of Internal Audit are the Business Unit Management, the Executive Committee and the Audit Committee. To be able to respond to ad hoc audits or special projects many leave a contingency in their audit plan to facilitate these requests.

This is a strong sign that audit functions are expected to become strategic advisors.


A Practical Example


It is important for the Chief Audit Executive to vet the strategic audit plan with key stakeholders namely management (business unit and senior) and obtain approval from the Audit Committee / Board. This gives the key stakeholders the opportunity to understand which audits can be scheduled for the upcoming year and which audits are not expected to receive adequate attention, and to request or suggest any changes or revisions to the Plan.


The key to success is to keep an open communication channel with all key stakeholders and align the Internal Audit function with the strategic objectives of the company.


THANK YOU


Documents

Challenges Faced in Developing Audit Plans and Programs 21 st March, 2013