A Risk-Based Plan with Fewer Hours Than Commitments
A state health authority's internal audit activity has 9 FTE auditors and 14,500 gross available hours for the coming year. After leave, training, and administration, the CAE estimates 10,800 engagement hours. The audit committee expects coverage of 22 entities. The new three-year strategic plan requires audits of a USD 1.2 billion Medicaid managed-care program, a recently implemented electronic health record (EHR), and 14 community clinics. Last year 30% of planned engagements were deferred; two high-risk clinics had repeat findings on cash handling. The CFO wants 2,000 hours for a pre-implementation review of a new claims system. The CIO asks for a cybersecurity audit after a peer agency suffered ransomware. The risk register rates EHR downtime as high likelihood and high impact but omits third-party claims processing. Board members ask why audit keeps returning to the same clinics. The CAE must present a risk-based plan in six weeks.
1. How should the CAE prioritize the available 10,800 engagement hours across these competing demands?
Read the worked answer
Start by converting gross hours to realistic capacity: 10,800 engagement hours is the constraint, so the plan cannot promise full coverage of 22 entities. Build an engagement-level risk score using likelihood and impact, financial and service criticality, control environment, time since last audit, prior findings, management action status, third-party dependence, and strategic change.
The Medicaid managed-care program and EHR are high-risk because of size, change, and service continuity; the 14 clinics need a cycle approach, with the two repeat-finding clinics receiving focused follow-up and the rest sampled. Cybersecurity should be included because the peer ransomware event is a credible threat and the risk register is incomplete on third-party claims processing.
The CFO's 2,000-hour request is a consulting request; it must be assessed on risk and independence, not on the CFO's authority, and is unlikely to fit at that level. Reserve hours for follow-up, fraud hotline work, and unforeseen requests. Document the risk scores, trade-offs, and deferred items so the committee approves a plan with known gaps, not an illusion of complete coverage.
2. How should the CAE respond to the CFO and CIO requests and to the board's concern about repeated clinic audits?
Read the worked answer
Respond to the CFO and CIO in writing, explaining the risk criteria and the hours available. Offer a scoped claims-system review, for example 300 to 500 hours focused on requirements, access, and data conversion, rather than 2,000 hours; confirm that audit will not design controls, to protect objectivity. Fold the cybersecurity request into a risk-based cyber engagement and coordinate with IT rather than duplicate work.
On the board's question, explain that returning to the same clinics is evidence that prior findings were not remediated; propose that the committee ask management for a root-cause plan and set a follow-up date. If the board wants a different mix, show the trade-off: adding hours to one area means deferring another high-risk area.
Do not let the CFO or CIO set the plan; the audit committee approves it. If they insist, escalate through the committee and document the request. Update the risk register to include third-party claims processing and use that update to justify the cyber and vendor oversight work.
3. If the plan cannot cover all 22 entities, how should the CAE communicate and document the coverage gap?
Read the worked answer
If the plan cannot cover all 22 entities, state that explicitly in the plan and in the audit committee memo. Use a multi-year coverage cycle, with high-risk entities audited annually or more often and low-risk entities on a three-year cycle, subject to continuous monitoring.
Quantify the coverage gap in hours and risk terms, and identify which entities receive no assurance this year. Ask management and the committee to acknowledge the residual risk in writing, consistent with their risk acceptance role. Avoid presenting the plan as a guarantee.
Include a contingency reserve and a trigger for re-planning if a new risk emerges. Report progress quarterly against the approved plan and explain deferrals before year-end, not after. If the committee directs a different allocation, document the direction and its risk implications. This protects the CAE from later criticism and keeps the plan honest.