Internal Audit Principles, Planning and the Audit Programme
Domain 3 tests whether you can plan a risk-based internal audit programme and a specific TIA-942 audit plan. The exam distinguishes programme-level management from audit-level planning.
Audit principles
Internal auditors need independence, objectivity, integrity, confidentiality and competence. Do not audit your own design or installation work; if you designed the solution, another auditor must test it. Use an evidence-based approach and keep judgement separate from fact. Competence includes TIA-942 knowledge plus enough electrical, mechanical and cabling awareness to challenge technical claims.
Programme versus plan
An audit programme is the periodic set of audits, prioritised by risk. It considers site criticality, Rated level, incidents, changes, previous findings and management objectives. An individual audit plan defines objectives, scope, criteria, dates, resources, methods, sampling approach, roles and reporting arrangements. A checklist is not a plan.
Planning steps
- Fix the criteria and edition, plus internal policies.
- Define scope, sites, systems and exclusions.
- Rank risk and set frequency and depth.
- Design the evidence plan: documents, interviews, observation, sampling, testing.
- Confirm logistics, access, safety and confidentiality.
- Agree reporting, follow-up and escalation.
Worked example
Three sites: A is Rated-4 with a recent UPS transfer failure and an open finding; B is Rated-2 and stable; C is a new build not yet commissioned. Risk ranking: A is highest because of criticality, incident history and open finding; C is medium-high because it has no operating history; B is lower. The programme audits A twice - initial and follow-up - audits C before go-live, and audits B annually. A's plan covers electrical topology, UPS test logs and maintenance records; the criteria are TIA-942-B plus the internal standard; the sample includes all transfer tests and 20% of UPS modules. Frequency follows risk, not equal treatment.
Traps that cost marks
- Calling a checklist an audit plan without scope, criteria or sampling rationale.
- Selecting samples before defining the criteria.
- Reviewing documents only and never observing physical separation or labelling.
- Assigning an auditor who designed the redundancy solution.
- Failing to update the programme after a major incident or design change.
- Auditing every site at the same frequency regardless of criticality.