ToolAudit Planning
Audit Scope Builder Tool
Turn a broad request such as “audit procurement” into a clear, risk-based scope linking objectives, risks, processes, locations, systems and exclusions.
PDF • 6 Pages • Free
Guide
How to Plan a Risk-Based Internal Audit
A six-step approach for moving from business objectives and risks to a focused, defensible audit plan — with clear objectives, scope, evidence and agreed boundaries.
What you'll find inside
- Why risk-based planning matters and the outcome to aim for
- A six-step approach from the decision the audit supports to agreed scope, timing and stakeholder expectations
- Guidance on prioritizing risks and turning them into audit objectives and scope
- An auditor prompt and a quality check to test whether your evidence supports the conclusion
- Worked example: replacing “audit procurement end to end” with a risk-focused procurement objective
- Quick reference with practical reminders and a five-question mini self-check, including why to document what is out of scope
Best for
- New Internal Auditors
- Internal Auditors
- Senior Internal Auditors
- Audit Managers
Resource information
- Format:
- Pages:
- 6
- Price:
- Free
- Registration:
- Not required
About This Resource
Many audits start from a recycled program and a broad request such as "audit the procurement process end to end". This guide shows how to move from business risk to a focused, defensible audit plan.
Use it at the start of an engagement. It follows six steps: clarify why the audit matters and what decision it should support; identify the business objectives and the risks that could prevent them; prioritize the risks that deserve audit attention; translate those risks into audit objectives and scope; choose evidence, tests and resources that can answer the objectives; and agree practical boundaries, timing and stakeholder expectations. An auditor prompt asks what evidence would convince another experienced auditor, and a quality check confirms the plan answers the original question.
The worked example contrasts that weak "end to end" approach with a better one: assessing whether supplier onboarding, purchase approval and payment controls manage fraud, unauthorized spend and supplier-performance risk. The quick reference reminds you that planning should start with business risk, that a smaller scope with clear objectives usually gives stronger assurance, and that out-of-scope areas should be documented so the engagement does not quietly expand. Finish with the mini self-check before presenting the plan.
© Salih Ahmed Islam
Related Internal Audit Resources
ToolRisk Assessment
Risk Prioritization Tool
Reduce a long risk list to the few risks that deserve audit attention, scoring impact, likelihood, velocity, control weakness and sensitivity.
PDF • 6 Pages • Free
ChecklistAudit Planning
Internal Audit Planning Checklist
Check that an engagement is ready for fieldwork: purpose linked to business risk, prior issues reviewed, risks and scope explicit, out-of-scope areas justified, and resources and timing realistic.
PDF • 6 Pages • Free
TemplateAudit Planning
Audit Engagement Planning Template
Turn an audit request into a focused, risk-based engagement plan, documenting purpose, objectives, in- and out-of-scope areas, walkthroughs, data needs and milestones in one reviewable record.
PDF • 6 Pages • Free