Welp MagazineTwo Key Internal Audit Planning Aspects:
- The Preparation of the Annual Audit Plan
- The Drafting of Audit Programs
The Internal Audit Plan is a strategic document that helps to enable the Internal Audit Activity to achieve its vision and mission. The Practice Guide (Developing the Internal Audit Strategic Plan) discusses critical steps necessary to develop a comprehensive internal audit strategic plan including:
- Understanding the relevant industry and the organisation’s objectives;
- Consider the IPPF Standards and Guidance;
- Understand Stakeholder Expectations;
- Update the Internal Audit Vision and Mission;
- Define the critical success factors;
- Perform a SWOT Analysis;
- Identify key initiatives.
Challenges of Audit Planning:
Challenge 1:
The structure of the Internal Audit department may be flat, pyramidical or a combination of both depending on the size of the organisation.
The flat-organisation structure may have greatest strength in terms of access to the organisation objectives, but if the organisation has a culture which does not empower and encourage the audit function to question things, then the best audit plan is worthless.
As such, access to Top Management may be a key to success.
For example, in a pyramidical structure, the audit function may be embedded within the accounting or IT function. Subsequently, this layer of management may block access to the Executive function where access may be necessary for obtaining an up-to-date vision and mission. If the Executive is not actively engaged in the audit process, this invariably may result in a diluted audit plan.
A flat organisation structure may also have a similar effect if there is no peer-level engagement among the managers of the audit function.
Challenge 2:
An audit plan must be timely to be relevant. Schedule of planned audits may be delayed due to lack of access to senior management or priority work arising from compliance concerns.
Challenge 3:
Availability of experienced auditors. If internal auditors are needed to perform non-policy jobs, such as IT technicians, then there may be insufficient time to carry out scheduled audits.
Challenge 4:
Resourcing issues have limited capacity to cover all activities and areas of responsibility.
Challenge 5:
A lack of key audit skills such as testing of IT systems or the lack of knowledge of the organisation and industry.
Challenge 6:
Audit projects may be delayed because of the lack of internal audit staff experienced in the required audit area.
Challenge 7:
If the audit plan is not updated, new initiatives may be overlooked and consequently not scheduled for audit. If an annual audit plan is not updated, then the audit manager may begin the new year with a plan that is no longer relevant to the organisation.
Challenge 8:
If management change during the year, this could affect the internal audit activity. If people new to the organisation are promoted to senior management, additional orientation time may be required to update them on the organisation’s strategic goals and objectives. Even if new senior management are hired, they may not have the opportunity to provide input into the audit plan.
Challenge 9:
Overlapping audit plans if the organisation operates in more than one legal entity. Without the alignment of audit objectives, the reputation of the operational activities may be destroyed.
Challenge 10:
Lack of vision and mission from management will result in a weak audit program. If senior management does not support the need for auditor’s independence at the operational level, the implementation of corporate governance may be impeded.
All of the challenges described above may contribute to less than desirable results. Many of them may be considered to be surprises that occur shortly before an audit. However, if all the time factors and risk factors are considered, a clear understanding of the auditee’s expectations may be developed. Internal auditors are then able to plan alternative methods of achieving audit objectives and are more likely to achieve positive results. The success of future internal audit plans relies on the work of previous audit activity and good planning. The planning process should be critical to effective internal audit planning.
