Building the annual audit plan
Internal Audit → Annual Audit Plans
The annual plan is the document your Audit Committee approves and then holds you to for a year. Everything else in the module hangs off it: engagements are created from it, capacity is measured against it, and at year end your coverage is judged by it.
It is built from your audit universe — the list of things that could be audited — ranked by risk, and cut to fit the days your team actually has.
The order of work
Five things have to be true before a plan means anything, and the product now shows you which of them are outstanding. Open a plan and the Planning readiness panel lists each one with what is missing and a link straight to it.
| Step | Where | What it is |
|---|---|---|
| 1. Audit universe | Audit Universe | Every auditable entity — a process, a system, a branch, a subsidiary. |
| 2. Risk factors | Risk Factors | What you score entities against, and how heavily each one counts. |
| 3. Risk scoring | Audit Universe → Score | Each entity rated 1–5 on each factor, for this cycle. |
| 4. Effort estimates | Audit Universe → Configure | Roughly how many days each audit takes. |
| 5. Capacity | Capacity Planning | Auditor days available, net of leave, training, admin and a reserve. |
You can work them in any order, but the plan will not generate a suggestion until the blocking ones are done.
Scoring the universe
Open Audit Universe and choose Score on any entity. You will see only the factors that apply to it — the universal ones plus any pack for its category — each rated 1 to 5. The composite score out of 100 is calculated for you and cannot be typed in directly.
A factor you leave unscored is skipped, not counted as zero. If you scored something wrongly, clear puts it back to unscored.
Extreme scores move the composite most, and they are the ones a committee member or an external quality assessor will question first. A score of 1 or 5 therefore needs a short note saying why. Scores of 2 to 4 do not — asking for prose on every factor across a whole universe produces filler, which is worse than nothing.
Mandatory audits
Some audits are not discretionary: a regulator requires them, or the board has directed them. Mark those entities Mandatory in Configure and state the basis — the specific obligation, such as "SAMA CSF 3.3.1 — annual review".
Mandatory entities are committed to the plan before anything else, in risk order, and are never deferred to fit the capacity. If your mandatory commitments alone exceed your capacity, the plan tells you so rather than quietly dropping one — that gap is a resourcing decision for your committee, and it prints in the plan paper.
The basis is required, because a flag without a stated obligation is an opinion, and this one outranks your risk scores.
Generating the plan
On the plan, enter your available auditor days — or better, derive them in Capacity Planning and use Apply to FY plan, which makes the number defensible instead of asserted — then choose Generate suggestion.
The suggestion lists:
- Selected — what fits, mandatory audits first, then highest risk down
- Deferred — what does not fit, each with the reason why
Tick and untick freely; the suggestion is a proposal, not a decision. Then Add selected as engagements.
Scores carried over from last cycle
Scoring is per cycle. An entity you scored last year still shows its risk score and still ranks on it — but it has not been re-assessed for this cycle, and the plan paper says so explicitly, separately from entities nobody has ever scored. The two look identical in the table and are not the same thing: one ranks on last year's judgement, the other on audit-cycle coverage alone.
If fewer than half your active entities have been scored for the cycle, the suggestion is refused and the readiness panel says so. Below that point the ranking is not really a ranking — every unscored entity ties with every other, so what you would get is a list ordered by audit-cycle coverage wearing the appearance of a risk assessment. Between 50% and 90% a plan generates and carries a written caveat into the plan paper.
Why something you expected is in the deferred list
On screen, while you are building the plan, the suggestion fills the remaining capacity with whatever fits. An expensive high-risk audit can therefore be deferred while two cheaper, slightly lower-risk ones are selected — that gets more of the universe covered for the same days. It is deliberate, and each deferred entity says which happened:
- Did not fit — it was reached in the ranking, but was too big for what was left
- No capacity left — the days ran out above it
If a critical-tier entity is deferred, the plan warns you explicitly. You can always tick it back in; the utilisation figure will show you what that costs.
The exported paper words this differently, and more cautiously — see The Audit Committee paper. The suggestion knows the order it ranked things in; the paper, rendered later from a plan that may have been edited by hand since, does not, so it only claims what it can still prove.
Coverage over a cycle
The annual plan answers what are we auditing this year?. Your Audit Committee will also ask the other question — when did you last look at Treasury, and when will you look again? — and that can only be answered over several years.
Audit Universe → Coverage rotation shows it: every entity down the side, the next one, three or five cycles across, and for each cell whether that entity is planned (an engagement already exists), due, overdue, or not due at all. The same figures go into the committee paper.
It is projected from two things you already maintain: each entity's audit frequency and the date it was last audited — which the system stamps for you when an engagement closes.
The rotation is read-only on purpose. Nothing in it is approved, and an unapproved schedule sitting next to a plan your committee did approve would cause more confusion than it solves. If you want a different rotation, change an entity's frequency — that is the decision, and the projection follows it.
Setting frequency by risk tier
If everything sits on the default 12 months, the rotation is flat and tells you nothing, so the grid says so. Set frequency by tier fixes that in one step: critical and high every 12 months, medium every 24, low every 36.
It shows you exactly what would change before it writes anything, and it skips unscored entities — there is no tier to derive a frequency from, and picking one would look like a decision somebody made.
Approval
Two approvals, recorded separately, because they are different things.
- Approve plan stamps the Chief Audit Executive's approval.
- Record approval captures the Audit Committee date. The plan cannot be started until this is on record — it is never inferred from the CAE approval.
Approving a plan you built is a self-approval, and every other gate in the audit module keeps the doer and the checker apart. You are not blocked — a sole auditor could never proceed otherwise — but you are asked to record why it is acceptable, and that note goes onto the plan's audit trail.
Sending a plan back
A committee that asks for changes has somewhere to put that: Return to draft on an approved plan reopens it for editing and clears the approval stamps, so an unapproved plan never carries an approval trail. The amendment history survives.
Cancel plan is terminal — use Return to draft if you mean to revise it.
Changing an approved plan
Adding engagements to a plan that is already approved or in progress is an amendment, and requires a reason. Amendments appear in their own section on the plan and in the exported paper, so the committee sees what changed after they approved it and why.
The Audit Committee paper
Word and PDF at the top of the plan produce the committee paper:
- The plan, its year and status
- Methodology — your factors, their weights, and how the banding works, in words
- Capacity — where the number came from
- Coverage over the cycle — what share of the universe the plan touches across the horizon, by tier, and what is not due within it at all
- Basis and limitations — the scoring caveat, if there is one
- Planned engagements, with mandatory ones showing their basis
- Not in this plan — everything considered and not selected, with the reason, and any mandatory audit that is missing
- Amendments after approval
- The approval trail
Sections 4 and 5 appear only when there is something to say; the rest renumber around them.
Word is there because this document gets worked on — pasted into a board pack, redlined before submission. PDF is the record of what was approved.
The Not in this plan section is the one that matters most. A plan that shows only what you will audit asks your committee to take your coverage on trust. A plan that shows what you decided not to audit, and why, is one they can actually discharge their oversight duty against.
It states only what it can prove. An entity is marked did not fit only when it genuinely exceeds your remaining capacity; otherwise it reads considered and not selected. If the plan leaves a meaningful share of capacity unused while deferring work, the paper says so — those deferrals are a matter of judgement, not of capacity, and your committee will ask which. A mandatory audit that is not in the plan is called out above everything else as an omission needing a decision.