Risk-Based Internal Audit Plan Template
A planning worksheet linking proposed internal audit engagements with objectives, risk rationale, capacity, independence, and approvals.
Key Takeaways
- ✓Link engagements to objectives and traceable risk information.
- ✓Show capacity constraints, dependencies, and independence safeguards.
- ✓Disclose exclusions and route changes through established governance.
Risk-Based Internal Audit Plan Template
Purpose and use
This plan helps an internal audit function document how proposed engagements relate to organizational objectives and assessed risks, available capacity, and approved priorities. It supports—not replaces—the chief audit executive’s independent judgment and the governing body’s oversight. Do not treat the plan as a guarantee that every risk will be audited.
Planning steps
1. Define the auditable universe and the information sources used to understand objectives and risks.
2. Record proposed engagements, rationale, scope, timing, estimated effort, dependencies, and skills.
3. Explain prioritization and changes from the prior plan; identify material gaps and constraints.
4. Confirm independence, conflicts, and coordination with other assurance providers.
5. Submit through the organization’s established approval and change process; monitor delivery and update when conditions change.
Blank annual plan
| Engagement / auditable unit | Objective / risk rationale | Proposed scope | Priority / method | Timing |
|---|
Frequently asked questions
Does a risk-based plan guarantee coverage of every high risk?
No. Disclose scope, capacity, exclusions, and residual coverage gaps to the authorized oversight body.
Who approves changes to the plan?
Follow the audit charter and governance process adopted by the organization.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.