Audit planning, scope, and risk-based audit program design
Programme versus plan
An audit programme is the set of audits planned over a period, sequenced by risk. An audit plan covers one audit and states objective, scope, criteria, schedule, team and methods. Questions deliberately swap the two.
The four anchors
Objective - why the audit is being done and what decision it informs. Scope - which entities, sites, processes, systems, time period, and what is excluded. Criteria - the policies, contractual terms, regulatory requirements, standard clauses and the organisation's own continuity standards the evidence is measured against. Evidence plan - what will be examined, sampled, interviewed and observed.
Risk-based design
Rank coverage by impact multiplied by likelihood: critical products and services from the business impact analysis, single points of failure, third parties and their continuity capability, locations with high maximum tolerable period of disruption exposure, prior findings and open corrective actions, recent change (new system, new site, merger), and the maturity of the function. Risk-based does not mean auditing only the top item; it means effort is proportionate and the rationale is written down.
Traps
Treating a checklist as a plan; omitting criteria so no finding is defensible; scope creep into parent organisations or suppliers without the client's agreement; ignoring follow-up of the previous audit; planning an exhaustive document review when sampling would suffice.
Worked example: an internal audit function has 1,200 hours. It allocates 40% to the payments service (MTPD four hours, no tested alternate site), 25% to two outsourced data centres never exercised with the bank, 20% to other units by rotation, 10% to follow-up of prior findings, 5% to programme quality review. That allocation, with its written rationale, is the audit programme.