Course Overview

Course Objective

To equip participants with the practical methodology to move from traditional cyclical auditing to a dynamic, risk-based approach. This module focuses on how to build a comprehensive audit universe, assess risks objectively, and develop an annual audit plan that allocates scarce audit resources where they matter most to the Board and business.

1. Developing the Audit Universe

• What is an Audit Universe and why it is the foundation of planning
• Sources for building the universe: Organizational structure, business processes, value chain, strategic objectives, regulatory obligations, ERP systems, and subsidiaries
• Granularity decisions: Defining auditable entities [divisions, departments, processes, projects, locations, key risks]
• Maintaining a living Audit Universe: Frequency of updates, linking with Enterprise Risk Register, and capturing emerging risks [cyber, ESG, third-party]
• Common pitfalls: Too high-level vs. too detailed universe, and duplication with other assurance functions
• Practical Exercise: Building an audit universe for a manufacturing / financial services company

1. Risk Assessment Methodologies

• Objectives of Internal Audit Risk Assessment vs. Enterprise Risk Management [ERM]
• Risk assessment criteria: Impact and Likelihood
• Qualitative vs. Quantitative assessment approaches
• Key Risk Indicators and data sources: Past audit findings, management concerns, whistleblowing, KPIs, losses, and regulatory inspections
• Inherent Risk vs. Residual Risk: Role of controls and control maturity
• Risk scoring models: Developing a 3×3, 4×4 or 5×5 risk matrix, weighting, and calibration workshops with stakeholders
• Documentation: Risk Assessment Sheet and Heat Maps[Financial][Operational][Regulatory][Reputational][Strategic]

1. Risk-Based Audit Planning [Annual Audit Plan]

• Regulatory and IIA Standard requirements for risk-based planning [Standard 9.2]
• Linkage between Audit Universe, Risk Assessment, and the Annual Audit Plan
• Top-down vs. Bottom-up planning approaches
• Inputs to consider: Board / Audit Committee expectations, management requests, regulatory focus, mandatory audits, strategy and change initiatives
• Rolling vs. Fixed Annual Plan: Incorporating agility for emerging risks
• Presenting the plan to the Audit Committee: Risk coverage analysis, rationale for inclusion / exclusion of audits, and obtaining formal approval

1. Prioritization Techniques & Resource Allocation

• Prioritization logic: High-risk areas, regulatory must-do, management requests, and audit history [when was it last audited]
• Effort estimation: Determining audit hours based on complexity, size, and assurance level
• Resource allocation: Mapping available resources [man-days, skills, budget] vs. demand
• Skill matrix analysis and gap identification: Need for co-sourcing, guest auditors, or data analytics specialists
• Managing resource constraints: What to do when you cannot audit all high risks? – Assurance mapping and combined assurance
• KPIs for audit planning: Risk coverage %, cycle time, and plan vs. actual

Learning Outcome

By the end of this module, participants will be able to independently develop and maintain an audit universe, conduct a structured risk assessment, draft a Board-ready risk-based annual audit plan, and justify prioritization and resource decisions with a clear audit trail.