I work for listed Financial/Tech company - I am curious to see how are IA teams have changed their Risk assessment or Internal Audit plans over the years? (i.e., coming up of preparing the audit plans) Have IA plans have moved from traditional annual plans to more agile/risk-based or become shorter-term (6 months)? Any concerns from audit committees?
Sort by:
It really depends on the size of the audit team, budget and resources. I've worked in a one-man shop and larger audit teams with more resources. It also depends on the CAE and management input. Over the years, I noted it is not so much about the plan but about the resourcing model. The resourcing model should provide flexibility to be able to respond to any emerging risks. A good mix between in-house core team and consultants is in my opinion a must in an ever-changing environment. This requires the CAE to have a healthy consulting budget. In a SME private company / one-man shop this is much harder to achieve, some flexibility should be allowed through the schedule. As well as what helps is regular discussions with CEO and leadership regarding risks. Usually they will be invested in addressing the risk before audit goes in.
Thank you for Sharing.

The use of traditional annual plans has evolved from how external audit training organisations have imparted an incorrectly interpreted requirement to internal auditing. Plan and frequency doesn't mean a yearly plan at given intervals - a schedule the organisation is enslaved to - that is not a requirement.
Scheduling should be a pull - not a push activity, and based on performance and risk