Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Audit Universe and Annual Audit Plan
The menu and the order
Think of a restaurant menu. The audit universe is the whole menu: everything audit could possibly look at. The annual audit plan is this year’s order: the dishes audit will actually serve, chosen because they matter most right now. Nobody orders the whole menu at once.
The audit universe
The audit universe is the complete list of everything that could be audited:
- business processes (order to cash, payroll, procurement)
- IT systems and infrastructure (ERP, network, cloud platforms)
- locations and legal entities
- major projects
- key third parties (outsourced providers, cloud services)
It has to be kept current. If the company buys another business or moves to a new cloud platform, the universe should grow to include it.
Ranking by risk
Each area is assessed for risk, using factors such as:
- impact on money, operations, customers, compliance or reputation if it fails
- complexity and rate of change
- volume and value of transactions
- previous findings, incidents and known weak controls
- time since the last audit
- management’s own risk assessment
- legal or contractual requirements that make some audits mandatory
The highest-ranked areas, plus the mandatory ones, become the annual plan.
The annual plan
The plan lists the audits for the year, with their objectives, timing and resources. It’s approved by the audit committee, as ITAF requires plans to be risk-based and independent of the people being audited.
The plan must be flexible. When something big changes, such as a major incident, a new law or a surprise system project, audit re-ranks the risks and the audit committee approves the change.
Example. The plan includes a review of the old payroll system. In March, the company announces that payroll is moving to a cloud provider in June. Audit replaces the old review with a review of the migration project and of the provider’s SOC 2 report. The audit committee approves the change.
If audit doesn’t have enough people or skills to cover the high-risk areas, the head of audit tells the audit committee. Quietly dropping risky areas would leave the board with false comfort.
Short-term and long-term planning
| Short-term planning | Long-term planning | |
|---|---|---|
| Looks ahead | The coming year | Several years |
| Decides | Which audits, when, and who does them | How the whole universe is covered over time; future skills needed |
| Driven by | Current risk ranking | Strategy and technology direction |
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Basis for choosing areas in the annual plan | A documented risk assessment |
| Who approves the annual audit plan | The audit committee |
| A major new system is introduced mid-year | Reassess risk and revise the plan |
| Not enough resources to cover high-risk areas | Report the gap to the audit committee |
| First step in building the annual plan | Identify the audit universe and assess risks |
In short
- The audit universe is the full list of things that could be audited: processes, systems, locations, legal entities, projects and key suppliers.
- The annual audit plan picks from the universe using a documented risk assessment.
- The audit committee approves the plan, and any significant changes to it.
- The plan must be flexible: when risks change, the plan changes.
- Short-term planning covers the coming year; long-term planning looks at covering the universe over several years and at future skills needs.
- If audit can't cover the high-risk areas with its resources, it tells the audit committee rather than quietly dropping them.
Exam traps
- Auditing everything on a fixed rotation regardless of risk isn't a risk-based plan.
- The audit committee approves the plan, not the CIO or the areas being audited.
- Dropping a high-risk area because management asked is an independence problem.
- A plan never revised during the year may be ignoring new risks.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From universe to plan