Why your Audit Committee is Getting Lost in Your Audit Plan

An audit plan should do more than list the areas Internal Audit intends to examine. It should make visible the reasoning that connects the organization’s strategy and risks to existing assurance, the gaps that remain, and the work Internal Audit proposes to undertake.

The problem may not be that the Audit Committee does not understand the audit plan. The problem may be that the plan does not show the Committee the reasoning that produced it.

The Risk-to-Assurance Logic Chain

This chain provides a way to explain why an area is being considered, what assurance already exists, and what remains uncovered. It also helps the Committee distinguish the organization’s risks from the places and processes Internal Audit can examine.

Week 1: Your Audit Universe Is Not Your Risk Universe

An audit universe is a map of the activities, functions, systems and processes that Internal Audit could examine. A risk universe is different: it describes the events or conditions that could prevent the organization from achieving its objectives. Confusing the two can make a plan look systematic while leaving its underlying priorities unexplained.

Accounts payable, payroll, cybersecurity, grants management and human resources are all potential auditable areas. They are not, by themselves, statements of organizational risk. “Grants management” identifies an area that can be examined. “Inability to demonstrate that restricted funds were used consistently with donor intent” describes a risk with a consequence for the organization. In the same way, “cybersecurity” names a domain; loss of critical operations or stakeholder confidence following a significant cyber incident describes an organizational exposure.

The distinction matters because an enterprise risk rarely sits neatly inside one department. It may cross several processes, systems, locations and management responsibilities. Conversely, one auditable area may contain several risks with very different levels of significance. Starting with the audit universe and scoring its components can therefore rank where Internal Audit is able to look before establishing why looking there matters.

A stronger planning process begins with strategy and the risks that could affect it. It then identifies the auditable exposures through which those risks may arise, considers what assurance is already provided, and determines whether a meaningful gap remains. The audit universe is still useful: it helps translate risk into work that can be examined. But it should not be mistaken for the organization’s risk picture.

The Committee should be able to follow the connection from each proposed audit to the risk it addresses—and understand what remains outside the proposed coverage.

Week 2: Stop Scoring Things Before You Know What Matters

Risk scoring can make an audit plan appear objective. A model may assign weights to impact, likelihood, financial exposure, management concern, control effectiveness and prior coverage, then produce a score such as 4.6. The number looks precise. But precision in the calculation does not guarantee that the right thing was assessed.

The first question is not whether the scoring formula is mathematically consistent. It is: what exactly is being scored—a department, a process, a system, a broad domain or a clearly defined enterprise risk? Consider cybersecurity. Treating “cybersecurity” as one item can hide several different consequences: interruption of critical operations, exposure of sensitive data, regulatory action or loss of stakeholder trust. These exposures may have different owners, controls, existing assurance sources and appropriate responses.

Scoring broad domains alongside narrow processes can also create misleading comparisons. Overlapping criteria may count the same concern more than once. Management attention may reflect recent events rather than underlying exposure. A ranking can therefore look authoritative while resting on unclear definitions or assumptions.

A more disciplined sequence is to define the organizational objective; define the risk to that objective; identify the criteria relevant to that risk; apply the scoring method; and then challenge the result through professional judgment. This does not mean abandoning scoring. A well-designed method can support consistency, structure discussion and reveal differences in judgment. It means using the method only after the subject and purpose of the assessment are clear.

The Audit Committee should be able to ask what assumptions sit beneath the scores, whether the ranking would change if those assumptions changed, and whether the resulting priorities still reflect the risks that matter most to the organization.

Scoring should structure professional judgment—not substitute for it.

Week 3: Risk-Based Auditing Should Start With the Business

Risk-based audit planning should begin with the organization’s purpose and current circumstances, rather than with last year’s plan. Refreshing an inherited audit universe, interviewing management and rerunning a scoring model can be orderly, but those steps may carry forward an outdated picture of the organization.

That risk increases after rapid growth, new funding, leadership turnover, restructuring, the launch of new business lines or a technology transformation. In those circumstances, rescoring the old map does not make the map current.

A stronger planning process works through a connected sequence: understand the organization’s mission and strategy; consider its current context; identify the enterprise risks that could affect its objectives; determine the auditable exposures through which those risks may arise; assess the assurance needed; and then decide how Internal Audit can respond.

This changes the starting question. Instead of asking, “What should we audit?” Internal Audit first asks: What is the organization trying to accomplish? What has changed? What could prevent success? With those answers in view, it can decide where an engagement may add value and keep the audit universe grounded in the organization’s present reality.

Audit Committee question: What has changed in the organization since this audit universe was last reconsidered—not merely rescored?

What change in your organization most needs to be reflected in the next audit plan?

Week 4: A High Risk Does Not Automatically Mean “Audit It”

A high risk creates an assurance question; it does not automatically create an audit engagement. Before adding a high-priority risk to the audit plan, Internal Audit should ask what assurance already exists and whether that assurance is sufficient. Risk priority and audit priority are related, but they are not the same.

Existing assurance may come from management monitoring, compliance or legal review, external audit or regulators, and enterprise risk management, quality or specialist functions. The task is not simply to list these providers. Internal Audit needs to understand what each source covers, how reliable that coverage is, and whether it addresses the exposure that matters.

Coverage should be assessed rather than assumed. It may be strong, weak, fragmented or unreliable. Without that assessment, Internal Audit can duplicate work that is already being done—or conclude that a risk is covered when important parts of the exposure remain unaddressed.

The appropriate response should follow the assurance gap and the distinctive value Internal Audit can add. That may mean a full audit or targeted review; evaluating another provider’s work; offering advisory support or coordination; or monitoring the exposure. A full audit is one possible response, not the automatic response to every high risk.

Audit Committee question: Are we using Internal Audit to duplicate existing coverage or to address the gaps that matter?

Coming Next: Weeks 5–6

Week 5: Resources Should Shape the Plan—Not the Risk Universe

Week 6: Give the Audit Committee the Story, Not Just the Spreadsheet

About Ngong Governance Advisory

Ngong Governance Advisory helps organizations make the connections among strategy, risk, assurance and oversight more visible.