Establishing Risk

Based Internal Audit

Planning

Background and purpose of the

guide
IIA Standard 2010 which requires The chief audit executive must
establish risk-based plans to determine the priorities of the
internal audit.
IIA Standard 2010.A1 which requires that The
activitys plan of engagements must be based on
risk assessment, undertaken at least annually. The
management and the board must be considered in

internal audit
a documented
input of senior
this process.

IIA Standard 2010.A2 The chief audit executive must identify

and consider the expectations of senior management, the board,
and other stakeholders for internal audit opinions and other
conclusions.
IIA Standard 2020, The chief audit executive must communicate

Process..
These standards require the Head of Internal Audit (HIA) to
develop a risk-based plan. The HIA should take into account
the organisations risk management framework, including risk
appetite levels set by management for the different activities
or parts of the organisation. If a risk management framework
does not exist, the HIA uses his/her own judgment of risks
after consideration of input from senior management and the
board. The HIA must review and adjust the plan, as
necessary, in response to changes in the organisations
business, risks, operations, programs, systems, and controls.

Why is risk-based planning

important for an internal audit unit
The main challenge faced by majority of internal auditors is how
to allocate limited internal audit resources in the most effective
way
The objective is of risk-based planning is to ensure that the
Auditor examines subjects of highest risk to the achievement of
the organisations objectives.
The strategic and annual plans are important documents, which
are normally presented to management. The strategic plan
provides an opportunity to present the work of the internal
auditor and the benefits that will arise from the audit function.
It represents a shop window, which explains what internal audit
can do for management. The annual plan translates the
strategic plan into the audit assignments to be carried out in

Key Definitions
Event
Risk
Key risks
Inherent risk
Residual risk
Risk appetite
Risk factors