02 Audit Planning

A successful audit begins long before auditors start collecting evidence or testing controls.

The quality of an audit depends heavily on:

Planning

Poor planning can result in:

Wrong Scope

Missing Risks

Unnecessary Testing

Missing Stakeholders

Insufficient Evidence

Schedule Delays

Weak Findings

Unsupported Conclusions

Strong audit planning creates a clear path from:

Business Risk
      ↓
Audit Objective
      ↓
Scope
      ↓
Criteria
      ↓
Controls
      ↓
Testing
      ↓
Evidence
      ↓
Conclusion

This lesson explains how professional Internal Audit teams prepare an engagement before fieldwork begins.

Learning Objectives

By the end of this lesson, you will be able to:

• Explain why audit planning is necessary.

• Understand strategic and engagement-level audit planning.

• Build an audit universe.

• Perform risk-based audit prioritization.

• Define audit objectives.

• Establish audit scope.

• Identify scope exclusions.

• Determine applicable audit criteria.

• Perform preliminary risk assessment.

• identify processes and key controls.

• Build a Risk and Control Matrix.

• Develop an audit program.

• Identify stakeholders and control owners.

• Determine evidence requirements.

• Prepare an initial evidence request list.

• Plan interviews and walkthroughs.

• Define audit populations.

• Plan sampling approaches.

• Estimate audit resources.

• Develop an audit timeline.

• Conduct an audit kickoff meeting.

• Establish communication and escalation procedures.

• Determine fieldwork readiness.

1. What Is Audit Planning?

Audit planning is the process of determining:

Why Are We Auditing?

What Are We Auditing?

What Risks Matter?

Which Controls Matter?

What Will We Test?

What Evidence Is Needed?

Who Must Be Involved?

How Long Will It Take?

Who Will Perform the Work?

Planning transforms:

"We Need to Audit IAM"

into:

Objective
+
Scope
+
Criteria
+
Risks
+
Controls
+
Testing Strategy
+
Evidence Requirements
+
Timeline

2. Why Audit Planning Matters

Consider an audit request:

Audit our cloud environment.

This is too broad.

Does this mean:

AWS?

Azure?

GCP?

Identity?

Network Security?

Logging?

Encryption?

Vulnerability Management?

Kubernetes?

DevSecOps?

Compliance?

Without planning, the audit can quickly become unmanageable.

Planning converts a broad request into a defined engagement.

3. Two Levels of Audit Planning

Internal Audit commonly performs planning at two levels:

Enterprise Audit Planning
          +
Engagement Audit Planning

Enterprise Audit Planning

Determines:

What Should
Internal Audit
Audit?

Engagement Planning

Determines:

How Will
This Specific Audit
Be Performed?

4. Enterprise Audit Planning

Enterprise planning typically begins with:

Audit Universe
      ↓
Enterprise Risks
      ↓
Risk Assessment
      ↓
Audit Priorities
      ↓
Annual Audit Plan

5. Audit Universe

The audit universe represents all potentially auditable areas.

Example:

Enterprise
│
├── Cybersecurity
│   ├── IAM
│   ├── Vulnerability Management
│   ├── Security Operations
│   ├── Incident Response
│   └── Cloud Security
│
├── Technology
│   ├── Change Management
│   ├── Backup & Recovery
│   ├── Infrastructure
│   └── Application Development
│
├── Compliance
│   ├── PCI DSS
│   ├── SOC
│   ├── Privacy
│   └── Regulatory Compliance
│
├── Third Parties
│   ├── Vendor Risk
│   └── Supplier Security
│
└── Business Operations
    ├── Finance
    ├── HR
    └── Procurement

6. Create the Audit Universe Register

Create:

01 Audit Universe Register

Suggested fields:

Field	Purpose
Auditable Area	Process/system
Business Owner	Accountable owner
Criticality	Business importance
Inherent Risk	Risk before controls
Regulatory Exposure	Compliance significance
Last Audit	Previous assessment
Open Findings	Existing weaknesses
Major Changes	Transformation risk
Audit Priority	Final priority

7. Identify Enterprise Risks

Audit planning should align with enterprise risk.

Examples:

Cyberattack

Data Breach

Cloud Misconfiguration

Fraud

Privacy Violation

Regulatory Failure

Third-Party Failure

Service Outage

Financial Misstatement

8. Map Risks to Auditable Areas

Example:

Enterprise Risk	Auditable Area
Unauthorized access	IAM
Data breach	Data Protection
Ransomware	Security Operations
Service outage	Business Continuity
Third-party breach	Vendor Risk
Regulatory violation	Compliance

This creates:

Risk
      ↓
Auditable Process

9. Risk-Based Audit Planning

Audit resources are limited.

Suppose:

Audit Universe:
120 Areas

Available Capacity:
25 Audits

Internal Audit must prioritize.

Use:

Risk-Based
Audit Planning

10. Audit Priority Factors

Consider:

Business Criticality

Financial Impact

Cybersecurity Risk

Regulatory Exposure

Data Sensitivity

Previous Findings

Incident History

Control Maturity

Technology Change

Management Concern

Time Since Last Audit

11. Audit Risk Scoring

Example scale:

Score	Risk
1	Low
2	Medium
3	High
4	Critical

Example factors:

Business Impact       4
Cyber Risk            4
Regulatory Exposure   3
Recent Change         4
Previous Findings     3
                     ──
Total                18

12. Determine Audit Priority

Example:

Score	Priority
5–8	Low
9–12	Medium
13–16	High
17–20	Critical

Organizations should define their own methodology.

13. Consider Previous Audit Results

Review:

Previous Findings

Repeat Findings

Overdue Findings

Risk Acceptances

Previous Audit Rating

An area with repeated High findings may deserve greater priority.

14. Consider Major Changes

Audit risk increases when significant changes occur.

Examples:

Cloud Migration

New ERP

Acquisition

New SaaS Platform

AI Deployment

Organizational Restructure

New Regulation

New Payment Platform

15. Consider Incident History

Review:

Security Incidents

Fraud Events

Privacy Incidents

Major Outages

Regulatory Issues

Control Failures

A pattern of incidents may justify an audit.

16. Build the Annual Audit Plan

Create:

02 Annual Audit Plan

Example:

Audit	Risk	Quarter	Owner	Duration
IAM	Critical	Q1	Audit Team	6 weeks
Cloud Security	High	Q2	IT Audit	8 weeks
Vendor Risk	High	Q3	GRC Audit	5 weeks
BCP	High	Q4	IT Audit	4 weeks

17. Consider Audit Capacity

Available audit capacity depends on:

Auditors

Skills

Budget

Time

External Specialists

Competing Projects

18. Resource Estimation

Example:

IAM Audit

Planning       40 Hours
Fieldwork     120 Hours
Reporting      40 Hours
Follow-Up      20 Hours
              ─────────
Total         220 Hours

19. Skills Assessment

Determine whether the team has skills in:

Cloud

Cybersecurity

Finance

Privacy

Data Analytics

Application Security

Compliance

If not:

Co-Source

Specialist

External SME

may be required.

20. Engagement Planning Begins

Once an audit is selected:

Audit Selected
      ↓
Engagement Planning

21. Understand the Business Process

Before defining detailed tests, understand:

What Does
the Process Do?

Who Owns It?

Which Systems
Support It?

What Data
Does It Process?

What Can
Go Wrong?

22. Perform Background Research

Review:

Policies

Procedures

Architecture

Previous Audits

Risk Registers

Compliance Assessments

Incident Reports

Organization Charts

System Documentation

Previous Findings

23. Create Planning File

Create:

03 Audit Planning Memo

Include:

Background

Business Process

Audit Rationale

Objective

Scope

Criteria

Key Risks

Stakeholders

Resources

Timeline

24. Define the Audit Objective

The audit objective should explain:

What is the audit trying to determine?

Weak objective:

Review IAM

Strong objective:

Determine whether
identity and access
management controls
are appropriately designed
and operating effectively
to prevent unauthorized access.

25. Objective Formula

A useful structure:

Evaluate Whether
+
Specific Controls
+
Are Designed and Operating Effectively
+
To Address Defined Risk

26. Multiple Audit Objectives

An audit may have multiple objectives.

Example:

Objective 1:
Evaluate User Provisioning

Objective 2:
Evaluate Privileged Access

Objective 3:
Evaluate Access Reviews

Objective 4:
Evaluate User Termination

27. Define Audit Scope

Scope determines:

Processes

Systems

Business Units

Locations

Data

Time Period

28. Scope Example

Audit:
Identity & Access Management

Systems:
Microsoft Entra ID
AWS
Azure

Business Units:
Corporate IT

Period:
January–June 2026

Locations:
Global

29. Scope Boundaries

Clearly document:

In Scope

Out of Scope

Example:

In Scope

Employee IAM

Privileged Accounts

Access Reviews

Termination

Out of Scope

Customer IAM

Physical Access

Application Authorization

30. Why Scope Control Matters

Without boundaries:

Scope Creep

can occur.

Example:

IAM Audit
      ↓
Cloud Security
      ↓
Network Security
      ↓
Application Security
      ↓
Entire Cybersecurity Program

This creates ineffective auditing.

31. Scope Change

Sometimes new information requires scope expansion.

Use:

Scope Change
      ↓
Risk Justification
      ↓
Audit Manager Approval
      ↓
Stakeholder Communication

32. Identify Audit Criteria

Determine what requirements controls will be evaluated against.

Examples:

Internal Policies

Procedures

Security Standards

Contracts

Regulations

PCI DSS

ISO 27001

SOC Control Requirements

33. Criteria Register

Create:

04 Audit Criteria Register

Example:

Criteria ID	Source	Requirement
AC-01	IAM Policy	MFA required
AC-02	Access Standard	Quarterly reviews
AC-03	HR Procedure	Access removed after termination

34. Criteria Must Be Authoritative

Avoid criteria based on:

Auditor Preference

Instead use:

Approved Requirement

where possible.

35. Perform Preliminary Risk Assessment

Ask:

What Could
Go Wrong?

Example for IAM:

Unauthorized Access

Excessive Privileges

Orphan Accounts

Shared Accounts

Weak Authentication

Delayed Termination

36. Create Audit Risk Register

Create:

05 Engagement Risk Register

Example:

Risk ID	Risk	Impact	Likelihood	Rating
R01	Unauthorized admin access	High	High	Critical
R02	Orphan accounts	High	Medium	High
R03	Weak access review	Medium	High	High

37. Identify Control Objectives

For each risk determine:

What Should
Prevent or Detect
the Risk?

Example:

Risk:

Unauthorized
Privileged Access

Control objective:

Only Authorized Users
Receive Privileged Access

38. Identify Existing Controls

Examples:

MFA

RBAC

Approval Workflow

PAM

Quarterly Review

Automated Termination

39. Map Risks to Controls

Use:

Risk
      ↓
Control Objective
      ↓
Control

Example:

Unauthorized Access
      ↓
Prevent Unauthorized
Privileged Access
      ↓
MFA
+
PAM
+
Approval

40. Build Risk and Control Matrix

Create:

06 Risk and Control Matrix

Commonly:

RCM

41. RCM Structure

Risk	Control Objective	Control	Owner	Frequency	Test

42. Example RCM

Risk	Control	Frequency	Owner
Unauthorized access	MFA	Continuous	IAM
Excessive access	Access review	Quarterly	Managers
Orphan account	Termination process	Event-driven	IAM

43. Identify Key Controls

Prioritize:

Key Controls

Ask:

If This Control
Fails,
Could Material Risk
Occur?

If yes, it may be a key control.

44. Identify Control Type

Record whether control is:

Preventive

Detective

Corrective

and:

Manual

Automated

IT-Dependent Manual

45. Determine Control Frequency

Examples:

Continuous

Daily

Weekly

Monthly

Quarterly

Annually

Event-Driven

Frequency affects testing strategy.

46. Identify Control Owner

Every control should have an accountable owner.

Example:

Control	Owner
MFA	IAM Manager
Access Review	Business Manager
Termination	IAM Operations

47. Identify Evidence

For each control ask:

What Evidence
Would Prove
This Control
Operated?

48. Evidence Mapping

Example:

Control	Evidence
MFA	IAM configuration
Access review	Completed review records
Termination	HR + IAM timestamps
Approval	Access tickets

49. Evidence Quality

Determine whether evidence is:

Relevant

Reliable

Complete

Accurate

Period Appropriate

50. Prepare Evidence Request List

Create:

07 Initial Evidence Request List

Sometimes called:

PBC List

or:

Prepared By Client
Request List

51. Evidence Request Structure

ID	Request	Owner	Due Date	Status

52. Weak Evidence Request

Send User List

53. Strong Evidence Request

Provide the complete
population of active
privileged accounts
for AWS and Azure
as of June 30, 2026,
including username,
role, account,
creation date,
MFA status,
and account owner.

54. Evidence Request Principles

Specify:

System

Period

Population

Fields

Format

Owner

Due Date

55. Avoid Excessive Evidence Requests

Do not request:

Everything

because it creates:

Audit Fatigue

Unnecessary Work

Evidence Confusion

Every request should map to:

Risk
or
Control

56. Identify Stakeholders

Typical stakeholders include:

Process Owner

Control Owner

Business Owner

System Owner

Security

Compliance

Legal

HR

Technology

57. Stakeholder Register

Create:

08 Audit Stakeholder Register

Example:

Stakeholder	Role	Audit Responsibility
IAM Director	Process Owner	Overall coordination
IAM Manager	Control Owner	Evidence
HR Manager	Supporting Owner	Termination data

58. Identify Audit Sponsor

The sponsor may help:

Resolve Delays

Coordinate Leadership

Remove Roadblocks

59. Identify Primary Audit Contact

Define:

Single Point
of Coordination

where practical.

60. Plan Interviews

Identify:

Who Must
We Interview?

Examples:

Process Owner

Control Operators

System Administrators

Risk Owner

Compliance Team

61. Interview Plan

Create:

09 Interview Plan

Use:

Interview	Participant	Purpose	Duration
IAM Overview	IAM Director	Understand governance	60 min
Provisioning	IAM Ops	Understand process	45 min

62. Plan Walkthroughs

Walkthroughs should cover important processes.

Example:

New User
      ↓
Access Request
      ↓
Approval
      ↓
Provisioning
      ↓
Authentication
      ↓
Logging

63. Walkthrough Objectives

Determine:

Who Performs Control?

How?

Using Which System?

How Often?

What Evidence Exists?

What Happens
When Control Fails?

64. Build the Audit Program

Create:

10 Audit Program

The audit program defines the procedures auditors will perform.

65. Audit Program Structure

Test ID	Risk	Control	Audit Procedure	Evidence

66. Example Audit Procedure

Control:

Quarterly
Access Review

Procedure:

1. Obtain population
   of quarterly reviews.

2. Select sample.

3. Verify review
   was completed.

4. Verify reviewer
   was authorized.

5. Verify exceptions
   were remediated.

6. Record results.

67. Testing Strategy

Determine whether testing will evaluate:

Design Effectiveness

Operating Effectiveness

Both

68. Design Testing

Evaluate:

Does the Control
Adequately Address
the Risk?

69. Operating Effectiveness Testing

Evaluate:

Did the Control
Operate Consistently
During the Audit Period?

70. Determine Audit Population

For each test define:

Complete Population

Example:

All Employee
Terminations
January–June 2026

71. Population Completeness

Before sampling ask:

Is This Population
Complete?

If not:

Sample
May Be Invalid

72. Population Validation

Potential methods:

Reconcile to Source System

Compare Counts

Inspect Query

Validate Date Range

Compare Independent Report

73. Plan Sampling

Determine:

Population Size

Control Frequency

Risk

Sample Method

Expected Exceptions

74. Sampling Methods

Possible methods:

Random

Systematic

Judgmental

Risk-Based

75. Risk-Based Selection

For high-risk populations, auditors may intentionally select:

Privileged Accounts

High-Value Transactions

Emergency Changes

Terminated Executives

Known Exceptions

This should be documented.

76. Sample Size

Sample size depends on:

Risk

Population

Frequency

Methodology

Control Nature

Expected Deviation

Do not select sample sizes arbitrarily.

77. Consider Data Analytics

Instead of sampling:

50 Accounts

it may be possible to analyze:

50,000 Accounts

using data analytics.

78. Identify Data Requirements

Determine:

Which Data?

From Which System?

Which Fields?

Which Period?

Which Format?

79. Data Security

Audit evidence may contain:

Personal Data

Financial Data

Credentials

Security Configuration

Sensitive Business Data

Plan:

Secure Transfer

Restricted Storage

Access Control

Retention

Deletion

80. Audit Evidence Repository

Create:

Audit-2026-IAM/
│
├── 01 Planning/
├── 02 Scope/
├── 03 Risk/
├── 04 RCM/
├── 05 Evidence/
├── 06 Testing/
├── 07 Findings/
├── 08 Reporting/
└── 09 Follow-Up/

81. Define Naming Standards

Example:

AE-001_IAM-Policy.pdf

AE-002_User-Population.xlsx

AE-003_Access-Review-Q1.pdf

This improves traceability.

82. Determine Audit Resources

Identify:

Lead Auditor

Supporting Auditor

Technical Specialist

Data Analyst

Audit Manager

83. Responsibility Matrix

Create:

11 Audit Responsibility Matrix

Example:

Activity	Lead	Support	Reviewer
Planning	Auditor A	Auditor B	Manager
IAM Testing	Auditor B	SME	Auditor A
Reporting	Auditor A	Auditor B	Manager

84. Estimate Effort

Example:

Phase	Hours
Planning	40
Fieldwork	120
Findings	30
Reporting	40
Closure	20
Total	250

85. Develop Audit Timeline

Create:

12 Audit Timeline

Example:

Week 1
Planning

Week 2
Walkthroughs

Week 3–5
Fieldwork

Week 6
Findings Validation

Week 7
Draft Report

Week 8
Final Report

86. Define Milestones

Track:

Planning Complete

Kickoff Complete

Evidence Received

Walkthroughs Complete

Testing Complete

Findings Validated

Draft Issued

Final Issued

87. Identify Dependencies

Examples:

System Access

Evidence Availability

SME Availability

Data Extraction

External Vendor Evidence

88. Identify Audit Constraints

Document:

Limited Resources

System Migration

Year-End Freeze

Staff Leave

Regulatory Deadline

Data Availability

89. Audit Communication Plan

Create:

13 Audit Communication Plan

Define:

Kickoff

Weekly Status

Finding Discussion

Escalation

Draft Report

Final Report

90. Status Reporting

Weekly status might include:

Overall Status

Work Completed

Evidence Outstanding

Issues

Potential Findings

Upcoming Activities

91. Audit Status

Use:

Green

Amber

Red

Example:

Green
On Schedule

Amber
Evidence Delay

Red
Major Blocker

92. Escalation Criteria

Escalate when:

Critical Risk Identified

Evidence Repeatedly Delayed

Access Denied

Scope Disagreement

Potential Fraud

Major Security Incident

Management Interference

93. Audit Kickoff Meeting

The kickoff formally begins engagement execution.

Participants may include:

Internal Audit

Process Owner

Control Owners

Business Owner

Security / Compliance

Relevant SMEs

94. Kickoff Agenda

Cover:

Audit Purpose

Objectives

Scope

Out of Scope

Timeline

Evidence Requirements

Interviews

Communication

Escalation

Expected Deliverables

95. Kickoff Meeting Output

Create:

14 Audit Kickoff Record

Document:

Attendees

Scope Agreement

Questions

Dependencies

Actions

Due Dates

96. Planning Risk — Management Resistance

Possible signs:

Evidence Delays

Scope Challenges

Limited Access

Repeated Rescheduling

Do not immediately assume misconduct.

Document and escalate according to audit governance if necessary.

97. Planning Risk — Missing Documentation

If policies or procedures do not exist:

Missing Documentation

may itself indicate:

Control Design Weakness

but evaluate context before concluding.

98. Planning Risk — Unclear Ownership

If nobody can answer:

Who Owns
This Control?

that may indicate:

Governance Weakness

99. Planning Risk — Scope Too Large

Example:

Audit All
Cybersecurity Controls

Refine into manageable domains.

100. Planning Risk — Scope Too Small

Avoid excluding areas that could prevent the audit from achieving its objective.

Example:

Auditing privileged access but excluding:

Service Accounts

may create a significant blind spot.

101. Fraud Considerations

Where relevant, consider:

Fraud Risk

Management Override

Segregation of Duties

Unauthorized Transactions

102. Regulatory Considerations

Identify whether the audit must consider:

PCI DSS

Privacy Requirements

Financial Regulations

Contractual Obligations

Industry Standards

103. Technology Considerations

Modern audits may require understanding:

Cloud

APIs

Containers

SaaS

CI/CD

Infrastructure as Code

AI Systems

104. Third-Party Dependencies

Determine whether controls rely on:

Cloud Provider

SaaS Provider

Managed Service Provider

Payment Processor

Other Supplier

105. Reliance on Other Assurance

Sometimes existing assurance can reduce duplicate testing.

Examples:

SOC Reports

ISO Audits

External Assessments

Compliance Tests

But first determine:

Relevant?

Current?

Correct Scope?

Reliable?

106. Coordinate With Other Assurance Functions

Potential coordination:

Internal Audit
      +
Compliance
      +
Risk
      +
External Audit
      +
Security Assessment

can reduce:

Duplicate Evidence Requests

107. Avoid Over-Reliance

Do not conclude:

SOC 2 Exists
=
Everything Is Secure

Review:

Scope

Period

Controls

Exceptions

CUECs

108. Preliminary Analytics

Before fieldwork, analyze available data.

Examples:

User Accounts

Changes

Vulnerabilities

Incidents

Vendor Findings

This may identify areas requiring deeper testing.

109. Identify High-Risk Samples Early

Examples:

Administrators

Emergency Changes

Critical Vendors

Terminated Users

Failed Backups

High-Severity Vulnerabilities

110. Planning Documentation

At minimum maintain:

Audit Planning Memo

Objective

Scope

Criteria

Risk Assessment

RCM

Audit Program

Evidence Request List

Stakeholder Register

Timeline

111. Planning Review

Before fieldwork, the Audit Manager should review:

Objective

Scope

Risk Coverage

Key Controls

Testing Strategy

Evidence Requests

Resources

Timeline

112. Fieldwork Readiness Assessment

Ask:

Objective Defined?

Scope Approved?

Criteria Identified?

Risks Identified?

Controls Mapped?

Program Approved?

Evidence Requested?

Stakeholders Identified?

Resources Assigned?

Timeline Agreed?

113. Fieldwork Readiness Gate

Use:

Planning Complete
      ↓
Manager Review
      ↓
Ready?
      │
 ┌────┴────┐
No         Yes
↓           ↓
Resolve    Begin
Gaps       Fieldwork

114. Audit Planning Checklist

Engagement

• audit selected.

• audit rationale documented.

• engagement ID assigned.

• lead auditor assigned.

• audit manager assigned.

Background

• business process understood.

• previous audits reviewed.

• policies reviewed.

• risk registers reviewed.

• previous findings reviewed.

• incidents reviewed.

• major changes identified.

Objectives

• audit objectives documented.

• objectives are risk-based.

• objectives are achievable.

Scope

• systems identified.

• processes identified.

• locations identified.

• period defined.

• business units identified.

• out-of-scope areas documented.

Criteria

• applicable policies identified.

• standards identified.

• regulatory requirements identified.

• contractual requirements identified.

• criteria register created.

Risk

• key risks identified.

• risk ratings assigned.

• high-risk areas prioritized.

• fraud considerations reviewed.

• third-party dependencies considered.

Controls

• control objectives identified.

• controls identified.

• key controls identified.

• control owners identified.

• control frequencies identified.

• control types identified.

• RCM completed.

Audit Program

• procedures developed.

• design tests defined.

• operating-effectiveness tests defined.

• populations identified.

• sampling approach defined.

• analytics opportunities considered.

Evidence

• evidence requirements mapped.

• evidence owners identified.

• evidence request list prepared.

• due dates established.

• secure evidence repository established.

Stakeholders

• process owner identified.

• control owners identified.

• primary contact identified.

• interview participants identified.

• walkthroughs scheduled.

Resources

• auditors assigned.

• skills assessed.

• SMEs identified.

• hours estimated.

• external resources identified if required.

Timeline

• planning dates defined.

• fieldwork dates defined.

• reporting dates defined.

• milestones established.

• dependencies identified.

Communication

• kickoff scheduled.

• communication cadence defined.

• escalation path defined.

• stakeholders informed.

Approval

• planning documentation reviewed.

• scope approved.

• audit program approved.

• fieldwork readiness confirmed.

Audit Planning Deliverables

At completion, you should have:

01 Audit Universe Register

02 Annual Audit Plan

03 Audit Planning Memo

04 Audit Criteria Register

05 Engagement Risk Register

06 Risk and Control Matrix

07 Initial Evidence Request List

08 Audit Stakeholder Register

09 Interview Plan

10 Audit Program

11 Audit Responsibility Matrix

12 Audit Timeline

13 Audit Communication Plan

14 Audit Kickoff Record

Audit Planning Example — IAM Audit

Objective

Determine whether IAM controls
are appropriately designed
and operating effectively
to prevent unauthorized access.

Scope

Microsoft Entra ID

AWS IAM

Employee Access

Privileged Access

January–June 2026

Key Risks

Unauthorized Access

Excessive Privileges

Orphan Accounts

Weak Authentication

Delayed Termination

Key Controls

MFA

Approval

RBAC

Quarterly Reviews

Automated Termination

Evidence

IAM Configuration

User Population

Access Requests

Access Reviews

Termination Records

Testing

Configuration Review

Population Analysis

Sampling

Reperformance

Exception Analysis

Audit Planning Decision Flow

Audit Selected
      ↓
Understand Process
      ↓
Identify Risks
      ↓
Define Objective
      ↓
Define Scope
      ↓
Identify Criteria
      ↓
Identify Controls
      ↓
Build RCM
      ↓
Develop Audit Program
      ↓
Determine Evidence
      ↓
Plan Sampling
      ↓
Identify Stakeholders
      ↓
Assign Resources
      ↓
Build Timeline
      ↓
Kickoff
      ↓
Fieldwork Ready

Common Audit Planning Mistakes

Mistake 1 — Starting Testing Immediately

Without planning:

Testing
≠
Risk-Based

Mistake 2 — Vague Objective

Review Security

does not provide enough direction.

Mistake 3 — Undefined Scope

Creates scope creep and stakeholder conflict.

Mistake 4 — No Risk Assessment

Auditors may spend time testing low-value controls.

Mistake 5 — Testing Every Control

Focus should generally prioritize controls relevant to material risks.

Mistake 6 — Poor Evidence Requests

Creates delays and unusable evidence.

Mistake 7 — No Population Definition

Sampling becomes unreliable.

Mistake 8 — Ignoring Previous Findings

Repeat control weaknesses may be missed.

Mistake 9 — Ignoring Technology Changes

Old audit programs may no longer match the environment.

Mistake 10 — No Stakeholder Alignment

Creates surprises during fieldwork and reporting.

Practical Audit Planning Mindset

Before fieldwork begins, an auditor should be able to answer:

Why Are We
Performing This Audit?

What Business Risk
Are We Addressing?

What Is
Our Objective?

What Is
In Scope?

What Is
Out of Scope?

What Criteria
Apply?

What Could
Go Wrong?

Which Controls
Address Those Risks?

Which Controls
Are Key?

Who Owns
Those Controls?

How Will
We Test Them?

What Population
Do We Need?

How Will
We Select Samples?

What Evidence
Do We Need?

Who Will
Provide It?

Which Interviews
Are Required?

Which Specialists
Do We Need?

What Is
Our Timeline?

How Will
Issues Be Escalated?

Are We Ready
for Fieldwork?

Key Takeaways

• Audit quality begins with audit planning.

• Enterprise planning determines what should be audited.

• Engagement planning determines how an individual audit will be performed.

• The audit universe defines the complete set of auditable areas.

• Risk-based planning helps prioritize limited audit resources.

• Audit objectives must explain what the engagement intends to determine.

• Scope should clearly define systems, processes, locations, business units, and time periods.

• Out-of-scope areas should also be documented.

• Audit criteria establish authoritative expectations.

• Preliminary risk assessment identifies what could go wrong.

• Risks should be mapped to control objectives and controls.

• The RCM provides the foundation for structured testing.

• Audit programs translate risks and controls into specific procedures.

• Evidence requests should be precise and tied to audit objectives.

• Audit populations must be validated before sampling.

• Stakeholders, resources, timelines, and dependencies should be identified before fieldwork.

• The kickoff meeting aligns Internal Audit and management.

• Fieldwork should begin only when planning is sufficiently complete.

Knowledge Check

Before continuing, make sure you can answer:

1. What is audit planning?

2. Why is planning important?

3. What is an audit universe?

4. What is risk-based audit planning?

5. What factors influence audit priority?

6. What is an Annual Audit Plan?

7. What is an audit objective?

8. What is audit scope?

9. Why should out-of-scope areas be documented?

10. What are audit criteria?

11. What is a preliminary risk assessment?

12. What is a control objective?

13. What is an RCM?

14. What is a key control?

15. What is an audit program?

16. What is an evidence request list?

17. What makes an evidence request effective?

18. Why must audit populations be validated?

19. What factors influence sampling?

20. Why are walkthroughs planned?

21. What is the purpose of an audit kickoff?

22. Why should dependencies be identified?

23. When should audit scope change?

24. Why should previous findings be reviewed?

25. What should be completed before fieldwork begins?

What’s Next?

➡️ Next: 03 — Audit Evidence

In the next lesson, you will move from planning the audit to collecting, evaluating, validating, protecting, and documenting the evidence needed to support audit conclusions.

You will work through:

Audit Objective
      ↓
Control
      ↓
Evidence Requirement
      ↓
Evidence Request
      ↓
Evidence Collection
      ↓
Completeness Validation
      ↓
Reliability Assessment
      ↓
Evidence Testing
      ↓
Cross-Validation
      ↓
Working Papers
      ↓
Audit Conclusion

You will learn how to work with policies, procedures, screenshots, system-generated reports, logs, tickets, configurations, audit trails, exports, interview evidence, third-party assurance reports, and other audit artifacts while maintaining evidence integrity and traceability.

This prepares you for the evidence-driven fieldwork used throughout the remainder of the Internal Auditing & Compliance Assessments module.