Internal Audit - Audit Project Selection or "annual Planning"

Audit Project Selection or "annual Planning"

Based on a risk assessment of the organization, internal auditors, management and oversight Boards determine where to focus internal auditing efforts. This focus or prioritization is part of the annual/multi-year audit planning. The audit plan is typically proposed by the CAE (sometimes with several options or alternatives) for the review and approval of the Audit Committee or Board of Directors. Internal auditing activity is generally conducted as one or more discrete assignments. A typical internal audit assignment involves the following steps:

1. Establish and communicate the scope and objectives for the audit to appropriate management.
2. Develop an understanding of the business area under review. This includes objectives, measurements, and key transaction types. This involves review of documents and interviews. Flowcharts and narratives may be created if necessary.
3. Describe the key risks facing the business activities within the scope of the audit.
4. Identify control procedures used to ensure each key risk and transaction type is properly controlled and monitored.
5. Develop and execute a risk-based sampling and testing approach to determine whether the most important controls are operating as intended.
6. Report problems identified and negotiate action plans with management to address the problems.
7. Follow-up on reported findings at appropriate intervals. Internal audit departments maintain a follow-up database for this purpose.

Audit assignment length varies based on the complexity of the activity being audited and Internal Audit resources available. Many of the above steps are iterative and may not all occur in the sequence indicated.

By analyzing and recommending business improvements in critical areas, auditors help the organization meet its objectives. In addition to assessing business processes, specialists called Information Technology (IT) Auditors review information technology controls.