Every audit team has limited time and people. Risk-based audit planning is how you decide where that effort goes. Instead of testing everything a little, you test the areas most likely to go wrong, and the areas where a failure would hurt most, in real depth. Done well, it produces fewer wasted hours, sharper findings and reports that management and boards actually read.
This guide walks through risk-based audit planning step by step. It works for internal audit engagements at banks, parastatals and NGOs, and for the planning phase of an external audit.
Why risk-based planning is now the expectation
- Internal auditors: The IIA’s Global Internal Audit Standards, effective from 9 January 2025, require the chief audit executive to base the internal audit plan on a documented assessment of the organisation’s strategies, objectives and risks (Standard 9.4, Internal Audit Plan). At engagement level, internal auditors must understand the activity under review and assess its significant risks before setting objectives and scope (Standard 13.2, Engagement Risk Assessment).
- External auditors: ISA 300 requires an overall audit strategy and a detailed audit plan, and ISA 315 (Revised 2019) requires the auditor to identify and assess risks of material misstatement so that further procedures respond to those risks.
In both cases, the logic is the same: understand the business, identify what could go wrong, rate it, and design work in proportion to the risk.
Risk-based audit planning, step by step
Step 1: Understand the entity and the area under review
Start with objectives, not controls. What is this function, process or entity trying to achieve? Read the strategic plan, budget, organisational chart, prior audit reports, board and audit committee minutes, regulatory correspondence and key policies. Interview the process owner.
In the local context, pay attention to the operating environment: multi-currency transactions and translation, exchange rate movements, regulatory requirements for public entities, and donor reporting conditions for NGOs.
Step 2: Identify the risks
For each key objective, ask what could stop it being achieved. Useful sources:
- Management’s own risk register, if one exists (but do not rely on it alone).
- Walkthroughs of the process, end to end.
- Prior audit findings that remain open or have recurred.
- Data analysis of the population: unusual trends, spikes, round amounts, duplicates or transactions outside normal hours.
Write each risk as a clear statement of cause and consequence, for example: “Supplier bank details can be changed without independent verification, leading to payments being diverted to fraudulent accounts.”
Step 3: Assess inherent risk
Rate each risk before considering controls, using two dimensions: impact (financial, regulatory, reputational, operational) and likelihood. A 1 to 5 scale for each is common, giving a score out of 25. Define each rating for your context: a “5” for financial impact at a commercial bank is a very different amount from a “5” at a district council.
Step 4: Identify and evaluate key controls
For the significant risks, record the controls management says are in place and make a preliminary judgement on their design. Are they preventive or detective, manual or automated? This gives you a view of residual risk and tells you where testing should concentrate.
Step 5: Prioritise and set objectives and scope
Rank the risks by residual score. High risks get detailed testing; medium risks get targeted testing; low risks may be covered by analytical review or deliberately excluded. Document exclusions and the reasons. Then write engagement objectives that link directly to the high-rated risks, and define scope: period, locations, systems, currencies and transaction types.
Step 6: Design the work programme and allocate resources
For each in-scope risk, specify the procedures (inspection, observation, enquiry, reperformance, data analytics), sample approach, responsible auditor and budgeted hours. Assign your most experienced people to the highest risks.
Step 7: Revisit the plan as you go
A risk-based plan is a living document. If fieldwork reveals a new risk, a control that does not exist, or an indication of fraud, reassess and adjust scope, and document why.
A simple risk assessment template
Here is how a planning risk matrix might look for a procurement and payments engagement.
| Risk | Impact (1–5) | Likelihood (1–5) | Inherent score | Key control | Control design | Residual rating | Planned response |
|---|---|---|---|---|---|---|---|
| Supplier bank details changed without verification | 5 | 4 | 20 | Call-back to supplier on changes, approved by finance manager | Partially effective | High | Test all bank detail changes in period; data match vendor and employee bank accounts |
| Duplicate payments to suppliers | 4 | 3 | 12 | System duplicate invoice check | Effective | Medium | Duplicate payment analysis on full population |
| Payments made in wrong currency or at incorrect exchange rate | 4 | 3 | 12 | Rate set centrally; second review of foreign currency payments | Partially effective | Medium | Recalculate rates on sample of ZiG and USD payments |
| Purchases not supported by approved requisitions | 3 | 2 | 6 | Three-way match in ERP | Effective | Low | Analytical review only |
Data-driven responses like duplicate payment analysis and vendor-employee bank matching become hard work in Excel once a payments file runs to hundreds of thousands of rows. For larger populations, a dedicated tool such as ProDataTool lets you summarise, filter and cross-tabulate full datasets during planning, so your risk ratings rest on evidence rather than assumption.
Common mistakes in risk-based audit planning
- Rolling forward last year’s plan. Copying the prior work programme and changing the dates is the opposite of risk-based. The risks have changed.
- Confusing risks with control weaknesses. “No segregation of duties” is a control gap; the risk is what could happen because of it. Write risks as events with consequences.
- Undefined rating scales. If “high impact” means something different to each auditor, scores are meaningless and hard to defend to the audit committee.
- Ignoring fraud and IT risks. Management override, access rights and system changes are easily missed.
- No link from risk to procedure. Every high risk should map to specific tests, and every test to a risk.
- Failing to document exclusions. If you decide not to cover an area, record why.
Quick planning checklist
- Objectives of the area under review documented.
- Prior findings, risk register and key data reviewed.
- Risks written as cause and consequence statements.
- Impact and likelihood scales defined and applied consistently.
- Key controls identified and design assessed for significant risks.
- Engagement objectives and scope linked to high-rated risks.
- Exclusions documented with reasons.
- Work programme maps each procedure to a risk, with owner and budget.
- Plan reviewed and approved before fieldwork.
Conclusion
Risk-based audit planning is a discipline, not a form to fill in. Understand the objectives, identify what could go wrong, rate it on defined scales, look at the controls, and spend your effort where the risk is highest.
Keeping that link visible across many engagements is where spreadsheets and shared folders start to struggle. Auditors Track GRC is internal audit management software built to help organisations across Africa digitise their audit work, from risk assessments and audit reviews through to findings, report writing and evidence attachments. Built-in libraries of risks, controls, audits and working papers give your team a head start on planning, multi-user department assignments keep responsibilities clear, and dashboards by department and engagement type show where your audit effort is going.
Ready to bring structure to your audit planning? Book a free demo of Auditors Track GRC and see how it supports risk-based auditing from plan to report.