Internal Audit Strategic Plan.

How to develop your Internal Audit Strategic Plan through our Annual Planning process

At the start of the year, we released our Guidance document on the Annual Planning process along with accompanying templates. You can visit our Guidance Hub for all the details on the Annual Planning process. Our Guidance document provides and overview of the end to end Annual Planning process, of which the Internal Audit Strategic Plan is one of the stages.

Throughout the Annual Planning process, we collect and gather a large amount of insight and details. All of this information will help inform both our Annual Plan and our Strategic Plan.

An Internal Audit Strategic Plan details the forward looking audit plan. It shows what audits are likely to be performed over the coming 3 to 5 years. It assists both management and the audit committee in understanding where risk lies within the organisation and internal audit is likely to use its resources to best cover the risk.

The strategic plan should also be aligned to the organisation’s strategy or objectives, whilst also preempting what future challenges the business may encounter. The document isn’t something which audit teams are wedded to, in fact, it should be reviewed and updated each year to ensure it still remain relevant and appropriate to the organisation.

In this post, we will step through what needs to be done to prepare for your Internal Audit Strategic Plan, what information should be included in it, and tips for communicating it to senior management and the audit committee.

What do we need to do in preparation for our Internal Audit Strategic Plan?

The end to end Annual Planning process.

We are currently at point 6 on the Annual Planning process diagram. To get to this point, we have considered our Internal Audit Charter and Internal Audit Strategy, reviewed our Audit Universe, understood and challenged the organisational strategy and any other external information, and have held multiple discussions with various stakeholders. Throughout all of this, we have collected a huge amount of information and updated our Audit Universe as we have progressed. With each update, the Audit Universe has begun to show us what are the more higher risk areas for the current year, what should be included in our plan for the current year, and what audits will likely form the plan over the coming years. All of this information will then feed into our Internal Audit Strategic Plan.

So what information needs to go into our Internal Audit Strategic Plan?

The opportunities are endless for what you may or may not want to include in the Internal Audit Strategic Plan. A couple of key rules to remember when compiling the Strategic Plan include:

• Keep it simple – don’t bury the reader in too much detail
• Tell the story – explain what the document is, what we did to get here, and the benefit to the organisation
• Be engaging – make sure the plan captures the readers attention and tells them something new, not what they already know. Audit is to add value as well as provide assurance.

An overview of our Internal Audit Strategic Plan template is included below as a guide to how your plan can be laid out.

This is only an extract of some pages from the template. To download an editable version of the Internal Audit Strategic Plan, please CLICK HERE.

As demonstrated in the template, we have told the story; explaining internal audits mission and objectives (which is extracted from the Internal Audit Strategic Plan), provided an overview of the planning process, and then detailed the strategic plan. The reader should be able to have a clear understanding of how we reached this conclusion.

The template uses a combination of both text and graphics. This is to not only keep the reader engaged, but to also help explain the process in a simple way without providing large amounts of text.

In addition to the above, you may wish to include some of following items in your strategic plan. Some of these are already included in this template, with other topics included in other templates such as the Annual Plan.

• Overview of the audit universe;
• List of previous audit activity;
• Details of possible future risk areas and their inclusion in the strategic plan;
• Overview of the audit team and current resourcing; and
• Maturity map – showing where we are now and where we want the business to be with regards to governance and controls.

Maturity maps are always a tricky thing to apply, particularly is using at a higher level or when making an assessment over a large part of the business. However, stating the maturity of the organisation in the strategic plan and stating where audit would like this to be in the future, provides a great starting point when performing the internal audit annual assessment – the process whereby we assess the current status of governance and controls in the organisation.

Throughout this entire process, it is important the audit remains open to challenges on what the risk areas and challenges are within the business. It because of this, that adopting a transparent approach can assist in ensuring both management and the audit committee are on-board and have bought into the current strategic plan.

To download an editable version of the Internal Audit Strategic Plan, please CLICK HERE.