Lion Cipher Lab
Build a risk-based internal audit plan from an audit universe
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
An internal audit or assurance function never has time to audit everything every year. Its first and most consequential decision is what to look at. The IIA's Global Internal Audit Standards expect that plan to be risk-based, and ISO 19011 describes managing an audit programme based on risks and opportunities. In practice, many teams re-run last year's plan with small edits. The comfortable areas get audited again and the hard or unfamiliar ones, such as a new cloud platform or a never-audited development process, drift for years. This lab turns the decision into something you can show and…
What you'll learn
- what an audit universe is and how to build one
- scoring auditable areas on risk, change, regulation, prior issues and staleness
- filling an audit-hour budget by risk
- coverage rules: top risks every year, nothing left too long
- comparing a risk-based plan with 'last year again'
- using the plan to argue for resources
- the judgement that a scoring formula cannot replace
Steps in this lab
- The audit universe and the planning decision
- Build and score the universe
- Write the planner
- Run the risk-based plan and last year's plan
- Find the budget your rules actually need
- Where the formula needs judgement