Risk Based Audit Planning A Practical Guide for CAEs

A long audit calendar can still leave the most important risks uncovered. Risk based audit planning helps a chief audit executive explain why particular engagements belong in the plan, which risks remain uncovered and whether the team has the capacity to deliver.

This guide turns the annual planning discussion into a documented decision: connect business objectives, risk evidence, proposed coverage and available audit days before asking for approval.

What is risk based audit planning?

Risk based audit planning uses the organization’s objectives and risk exposure to decide where internal audit should focus its work. The output is more than a ranked list. It connects proposed engagements to their purpose, timing, resource needs and remaining coverage gaps.

An annual plan decides which services the function will deliver over a period. An engagement plan defines the objectives, scope and approach for one assignment. Keep these decisions connected without treating them as the same document.

Risk based audit planning in 7 practical steps

1. Start with objectives and an audit universe

List the processes, entities, systems and major change programs that could require assurance. For each area, record the business objective it supports, its accountable owner and the last relevant assurance work. Use a consistent level of detail: comparing a whole subsidiary with one small process can distort prioritization.

A useful starting record includes an area ID, objective, process owner, location, systems used and related risks. Review it with management to identify omissions; management input informs the assessment without transferring internal audit’s judgment to process owners.

2. Gather evidence before assigning scores

Combine risk registers with prior findings, incidents, major projects, financial exposure and changes in people or systems. Record the source and assessment date. A confident-looking score based on stale information is a weak basis for allocating audit time.

Separate exposure from confidence in controls. A process with substantial inherent exposure may have well-tested controls; another may have limited assurance over controls that management considers effective. Document the distinction and identify where the assessment itself is uncertain.

3. Make the prioritization method explainable

Define your criteria and scoring scales before ranking areas. Factors might include impact, likelihood, change, unresolved findings and assurance gaps. Avoid counting the same issue twice under several headings.

The method should support professional judgment. Record an explanation when a high-scoring area is deferred or a lower-scoring engagement is included for a specific obligation. A score should make a decision easier to examine, rather than hide the rationale behind a formula.

4. Translate risks into proposed engagements

For each proposed assignment, state the objective, boundaries, expected skills and indicative effort. Check whether another assurance provider already covers part of the area and whether their work can appropriately inform your planning.

For example, a procurement risk could lead to an engagement covering vendor onboarding, approval controls and exception handling. That scope is more useful than a calendar entry labelled simply “Procurement.” Link the proposed work to a risk-control matrix so the risk-to-test relationship can be examined later.

5. Test the plan against available capacity

For risk based audit planning, count actual audit days rather than multiplying headcount by the full working year. Allow for leave, training, administration, supervision, reporting, follow-up and a response reserve. Check specialist availability as well as total days.

The following is an illustrative planning example, not an Abilite customer result or a recommended staffing benchmark.

That 90-day gap needs a decision: change scope, sequence work differently, obtain resources or explain the coverage limitation. Moving every assignment into a crowded calendar does not resolve it. Risk based audit planning should make that trade-off visible before the plan is approved.

6. Present coverage and gaps together

For risk based audit planning, prepare an approval pack that connects the risk assessment to planned work, the resource model and areas not covered. Distinguish deferred work from completed assurance. Include the reasons for significant exclusions and the decision required from the relevant governing body.

• Objectives and risks addressed by each engagement.
• Timing, indicative days and specialist needs.
• Other assurance work considered.
• High-risk areas outside the proposed scope.
• Capacity assumptions and alternative options.
• Approval record and process for significant changes.

7. Define when the plan will change

Set review points and event triggers, such as a major acquisition, a new core system, a significant incident or an important regulatory change. Retain a record of the reason, impact and approval for revisions.

Link the next assessment to open findings and management actions. Repeated overdue actions can inform the planning discussion, but they do not automatically prove that every affected process needs a full new engagement.

IIA standards and the Saudi context

The IIA’s Standard 9.4 links the internal audit plan to a documented assessment of organizational strategies, objectives and risks, informed by board and senior management input. The assessment is performed at least annually; the plan must identify resources and respond to relevant changes. Read the official Global Internal Audit Standards for the complete requirements. Our IIA standards overview provides additional context.

For local banks operating in Saudi Arabia, SAMA’s internal audit principles include annual planning grounded in documented risk assessment and audit committee approval. This is a sector-specific example; it does not make the same obligations applicable to every Saudi organization. Check the SAMA rulebook and the requirements applicable to your entity.

For a Saudi team, risk based audit planning may also involve bilingual collaboration, multiple entities and deployment requirements. Evaluate those needs alongside the method. Software can organize the workflow and evidence; purchasing a platform does not itself establish conformity with professional standards or regulatory requirements.

What to test in risk based audit planning software

Ask vendors to demonstrate your own planning scenario. Can you follow a business objective through its risks, proposed audit work and assigned resources? Can the team explain a coverage gap without rebuilding several spreadsheets?

Abilite brings planning and scheduling, engagement work, reporting and follow-up into a connected workspace. Its product material includes audit universe mapping, planning risk assessments, resource alignment and scheduling alerts. Review the configuration and workflow relevant to your team during the demonstration.

Frequently asked questions

What is the difference between an annual audit plan and an engagement plan?

The annual plan identifies the audit function’s proposed engagements and other services over a period. An engagement plan defines the objectives, scope and approach for a particular assignment.

How often should risk based audit planning be reviewed?

Review the plan at defined intervals and when significant changes affect risk or coverage. The IIA’s Standard 9.4 requires the underlying assessment at least annually and timely updates to the plan as relevant conditions change.

Can a small audit team use this approach?

Yes. Start with an explainable risk assessment, a realistic capacity calculation and a clear record of coverage gaps. The method should fit the team while preserving evidence for important decisions.

Does every Saudi organization follow the same planning requirements?

No. Requirements depend on the entity, sector and applicable obligations. SAMA’s internal audit principles for local banks are one specific example, rather than a universal rule for every Saudi business.

Can Abilite support the planning workflow?

Abilite’s product capabilities include audit universe mapping, planning risk assessments, resource alignment, scheduling and connected engagement work. Use a demo to confirm your configuration, deployment and workflow needs.

Final thoughts

Risk based audit planning is useful when the team can explain its choices: why work is included, what remains uncovered and how delivery fits available resources. Start with one clear chain from objective to risk, coverage and capacity, then test whether your current tools preserve that chain.