Checklist for Internal Audit Planning

Process Risk Description Control Test Performed

Risk that internal audits are not in line with the

objectives of the internal audit function, as per the A documented process, listing detailed 1. Check the comprehensiveness of the
Internal Audit Charter/ Terms of
internal audit charter of the entity (and terms of process for preparing Annual audit plan Auditing plan,
Internal Audit Engagement
keeping in view various facets of coverage
where it is an outsources engagement, where it is an outsourced 2. Check the Adherence to the Annual
required. It can be part of Audit Manual or a
engagement engagement) and also not in line with the overall Audit planning process as per document
separate document.
objectives of the organization.

Risk of leaving key elements of risk unattended Check the interactions Internal Audit has with
Process of continuous engagement with
Developing / Enhancing Business due to lack of Business / regulatory environment inside and outside stakeholders and other
stakeholders both inside and outside the
Knowledge research and documents as referred by the
knowledge. organization.
auditor.

1. Check the availability of Audit Universe

for the Organization/ Auditable Entity
1. Having Audit Universe for
Missing of Key Risk Area for coverage in Organization / Auditable Entity. 2. How many areas added or deleted from
Audit Universe Audit Universe.
Overall Internal Audit Plan 2. Review of the Audit Universe at regular
intervals. 3. See the risk rating of Various Audit
Universe areas and any change in the
risk ratings.

Inputs from Enterprise Risk Management

Plan Linkages with Enterprise Lack of Audit Planning process linkage with Team on key risk facing organization and Communication of inputs to and from
Risk Assessment Risk faced by the Organisation factoring the same in overall audit planning Enterprise Risk Management Team
process

Independent Risk Assessment for Risk of not prioritizing high risk area or missing 1. Doing Independent Risk assessment of
1. Check Independent risk assessment
various Auditable units (i.e., each auditable unit to arrive at correct
 Process Risk Description Control Test Performed
locations, functions, business them altogether. risk attributable to each auditable unit. along with methodology
units and legal entities including
2. Having adequate coverage in terms of 2. See the coverage for scope/ frequency /
third parties, wherever relevant).
scope/ frequency/ resource allocation to resource allocation, etc.
address the same.

Assessment of resources and skill set

Allocation of resources and skill set
Risk of inadequate resource allocation and allocation vis a vis criticality and complexity
depending upon criticality and complexity
Resource and time allocation of the auditable unit. Sufficiency of the time
available skill set of the auditable unit along with proper time
duration to have adequate coverage of
duration for the review
Auditable unit

1. Reviewing communication with

1. Communication of Audit Planning executive management
Risk of Audit Plan not in sync with process with executive management
Inputs for Audit plan for Organizational realities/ Organization objectives 2. Check various minutes of the meetings/
Executive Management 2. Various meeting to capture inputs or other documents to capture inputs
and strategies
3. Circulation of approved audit plan 3. Review approved and circulated audit
plan

1. Inputs from Audit Committee/ Board

Approval of Audit Plan with Risk of Audit Planning not aligned with those Review of Audit Committee minutes to check
Audit Committee / Board charged with governance 2. Approval of Final Audit plan by Audit inputs and approval
Committee

Risk of derailment or non-alignment of Overall Review of the Overall audit plan on regular Check the review performed by Chief Audit
Periodic review of Overall
basis by Chief Audit Executive and periodic executive and periodic reporting to Audit
Internal Audit plan Internal Audit Plan
reporting to Audit Committee / Board Committee / Board