Writing and updating strategic and annual plans Richard Maggs Astana September 2014

Why is this important A comprehensive strategic and annual plan of internal audit activity is crucial to the success of internal audit. The written plan is a key selling document – a shop window for IA to sell its services to Management A good plan can persuade management of the value of internal audit work A good plan can therefore help to ensure that the work of IA is fully supported by senior managers

Strategic Plans The strategic plan sets out in writing the judgements made about “audit needs” and the audits planned to provide reasonable assurance to management about the effectiveness of internal control The plan must contain: Clearly expressed objectives and performance indicators for what the IA function will achieve in the next 2-4 years The methodology used to prepare the strategy and how the IA unit has assessed risks that impact the entity’s objectives How IA will address areas of most significance The resources required and available to address audit needs An internal risk assessment of events which may impact the plan itself How work will be coordinated with others The higher or longer term goals of the IA unit

Annual Plans The annual audit plan translates the strategic plan into audit assignments to be carried out in the current year. It defines the purpose (title and objectives) and duration of each audit assignment and allocates staff and other resources accordingly The plan should provide a basis for agreeing the assignments to be undertaken and the timing of each assignment with the relevant managers Plans should be prepared before the year begins. Not all audits will be completed within a planning year so the plan for the coming year must take into account work that crosses the year-end.

Preparing annual plans The head of internal audit should consider several inputs to get a realistic work plan that provides added value to the organisation: The strategic audit plan assumptions and whether these are still valid in the light of audit findings. The latest annual plan taking into consideration the main findings from previous audits that indicating changes in risk. Organisational and timing constraints. (For example: locations that cannot be reached in the winter months; major periods of leave or office closure; implementation of new IT systems; high workload periods.) The resources that should be reserved for future unplanned work to avoid frequent reshuffling of the Annual Plan. Optional program of audits to take the place of postponed audit missions and/or a lower volume of unplanned work than forecasted.

Keeping plans up to date Risk is not a static concept. It changes over time. In addition, events that actually happen (e.g. a major reduction on budget) will generate new risks for the Organisation. The auditor must keep track of significant events and changes that happen during the year. This can be done by reviewing new policies, media responses and through discussions with key staff during the year. By keeping a finger on the pulse of the organisation IA can revise its programme of planned audits to reflect the most up to day situation in terms of risk

Dealing with additional requests for audit No plan is perfect and IA may be faced with requests to undertake audit work that was not in the plan. Heads of Internal Audit Units need to maintain a balance between responding positively to such requests and the need for the overall programme of work to provide an adequate level of assurance in relation to the main risks identified Discuss with senior managers the benefits of undertaking ad hoc audits and the impact this will have on annual plan of work Ensure that requests for ad hoc work are not being made to stop IA auditing other issues

General advice on writing good planning documents Keep it simple. The person who you want to read the plan may know nothing about audit. So avoid jargon and complexity. Keep it short. You want the plan to be read by busy people. Use short sentences and short paragraphs focused on one issue Use appendices for any detailed information Have a short one page executive summary for any document longer than ten pages Use headings to show clearly the structure and content of the document and help the reader to choose that areas to focus on Use bullets and graphics to break up text Use descriptive headings whenever possible.

Final comment Planning is a process not a document. A well written plan will not make good a poor planning process.. …but a poorly written plan can ruin a good planning process.