Building an Audit Plan from Strategic Objectives

OCCASION FOR DISCUSSION

The last five years have seen internal audit departments achieve great strides in broadening risk coverage, both in breadth and depth. However, even the most progressive audit departments struggle to incorporate strategic risks into the audit plan. Traditional risk assessment methodologies identify high priority strategic risk, but audit departments fail to effectively break these intangible risks down into auditable components and provide value to the organization through the evaluation of those pieces. Additionally, audit departments that have successfully conducted activities that address strategic risk confess that these engagements are typically an afterthought in the traditional audit planning process. We believe audit should rethink its approach to strategic risk auditing and pursue a more direct evaluation of all risks by using the company’s strategic objectives as the main input into the audit planning process.

PROPOSED AGENDA

• Uncovering why audit departments have not achieved their goals of incorporating strategic risk into the audit plan
• Defining the difference between auditing strategic risks and auditing strategies
• Providing a new model to link strategic objectives to the audit plan
• Defining boundaries by which audit should define its role in auditing strategy