“Why us, and why now?” is the first question most managers ask when an audit notification arrives, and the answer they fear is rarely the right one. Internal audits are not, as a rule, a response to suspicion about a particular manager. Most come from an annual plan built months earlier from a structured assessment of risk across the whole organization, approved by the audit committee, and scheduled around the audit function’s capacity. The rest come from events: an incident, a new system, an acquisition, a regulator’s concern, or a request from management itself. Once you understand how that plan is made, you can usually work out why your area was chosen, roughly when the auditors will be back, and what, legitimately, you can do to influence it.
This guide explains how audit plans choose what gets audited: the audit universe, the risk scoring that ranks every area, the cycle policies that turn scores into frequencies, the triggers that add audits during the year, how coverage differs by sector and size, the signs that an audit is coming, and what managers can do about it. It was rewritten in September 2026 around the Global Internal Audit Standards’ requirements for risk-based planning, and it ends with a worked example: one company’s annual plan, read from the side of the areas it chose. It is part of the site’s guide for people being audited; for auditors building the plan, the companion guide is how to build an internal audit plan.
In this guide
- Audits come from a plan, not a hunch
- How your area is scored
- What being chosen does and does not mean
- How often: cycle policies by risk band
- Triggers that bring an audit early
- How often by sector and size
- Signs an audit is coming
- What you can do about it
- If your area has been chosen
- Worked example: one company’s plan, from the areas’ side
- Questions managers ask about being chosen
- Related guides
Audits come from a plan, not a hunch
Standard 9.4 of the Global Internal Audit Standards requires the chief audit executive to base the internal audit plan on a documented assessment of the organization’s strategies, objectives and risks, taking into account input from the board and senior management, and to have the plan approved by the board. The plan must be reviewed and updated as the organization and its risks change. In practice, that produces an annual cycle that looks much the same in most organizations, whatever their size or sector.
It starts with the audit universe: a list of everything that could be audited, organized by business unit, process, location, system or risk. The site’s guide to building an audit universe explains how auditors assemble it. A mid-sized company’s universe might have sixty to a hundred entries; a large bank’s, several hundred. Each entry is then scored for risk, the scores are turned into required coverage by a cycle policy, the coverage is compared with the hours available, and the result is a plan: a list of engagements for the coming year, with a quarter, a budget of hours and the risk each is meant to address. What does not fit goes on a list of uncovered areas, which the audit committee sees.
| When (for a calendar year) | What happens | What it means for you |
|---|---|---|
| Third quarter | Risk assessment: interviews with executives and senior managers, review of incidents, results, changes and prior findings | If you are interviewed, what you say shapes your area’s score |
| Early fourth quarter | Scoring, cycle policy applied, draft plan and capacity model | Your area is ranked against every other |
| Late fourth quarter | Plan presented to and approved by the audit committee | The engagements and their quarters are largely fixed |
| First quarter | First engagements notified; plan communicated to management, often as a list of engagements | You can ask whether your area is in the plan and when |
| Mid-year | Plan reviewed against events; changes taken to the committee | Events in your area can add or move an audit |
| Throughout | Continuous analytics, validation of earlier findings, investigations and requests | Work that is not an audit engagement may still involve you |
Two things follow from this. First, the decision to audit your area was usually made by a process that looked at every area together, which is why “why us?” so often has a dull answer: your area scored higher than others this year. Second, the time to influence it is the risk assessment, months before the notification, not the week the letter arrives.
How your area is scored
Most audit functions score each entry in the universe on two dimensions, impact and likelihood, often on scales of one to five, and multiply them. Impact reflects how much is at stake: money flowing through the area, assets held, regulatory consequences, customers affected, reputation. Likelihood reflects how probable it is that something goes wrong: complexity, manual processing, recent change, control history, incidents, and susceptibility to fraud. Modifiers then move the result up or down: an area never audited, or not for three years or more, typically moves up a band, as does one with board or regulator interest; one with reliable monitoring by a second-line function may move down. The final score places the area in a band, commonly High, Medium or Low. The site’s guides to the internal audit risk assessment and risk-based auditing describe these models in detail.
| Factor | Why it raises the score | Example |
|---|---|---|
| Cash and liquid assets | Easy to misappropriate; losses are direct | Branches, depots, retail stores, treasury, payment operations |
| Volume and value of transactions | Small error rates become large amounts | Payables, payroll, revenue, claims |
| Manual processing and spreadsheets | More opportunity for error and override | Month-end close, reconciliations, pricing |
| Change: people, systems, structure | Controls often break during transitions | New ERP, reorganization, turnover in a key team |
| Incidents and losses | Evidence that controls failed once | A fraud, a data breach, a regulatory breach, a large write-off |
| Prior findings | Open or repeat issues suggest weak control | An Unsatisfactory report last cycle; overdue actions |
| Regulatory exposure | Breaches carry penalties and scrutiny | Anti-money laundering, privacy, safety, licensing |
| Time since last audit | Assurance goes stale | An area last audited four years ago, or never |
| Board, regulator or management interest | Direct requests carry weight | An audit committee question; a management request for assurance |
Look at the table from your own area’s side and you will usually see why you were chosen. A depot that handles cash, changed its system two years ago and has never been audited scores high on three factors before anything has gone wrong. That is also why the score says less about you than it seems to. Control history and management attention are among the factors, but a well-run area can still score high because of what it handles, and a weaker one can score low because it handles little. The score is mostly about exposure, not a verdict on the manager.
What being chosen does and does not mean
Because most managers only see the end of the planning process, the notification, they tend to read more into it than it says. The beliefs below come up in almost every first audit, and each has a plainer explanation.
| Belief | The usual reality |
|---|---|
| “They must suspect something.” | The area scored high on exposure: cash, volume, change or time since the last audit. Suspicion about individuals leads to investigations, which are run differently. |
| “Someone must have complained.” | Complaints feed the risk assessment occasionally, but most audits are scheduled months before anyone could have complained about anything recent. |
| “We were chosen because we are the weakest.” | Areas are ranked on impact as well as likelihood. The largest and most important areas are audited most often, however well they are run. |
| “The last audit went badly, so they are coming back to punish us.” | A poor result raises likelihood and brings validation testing, but the return visit is about whether the fixes worked, and a good follow-up result is the fastest way back to a normal cycle. |
| “If they found nothing last time, they will not come back.” | High-exposure areas are covered every year whatever the previous result. A clean report shortens the audit more often than it removes it. |
| “The audit was brought forward, so something is wrong.” | Audits move for many reasons: capacity, another engagement’s delay, a system date, the external auditor’s timetable. Ask. |
How often: cycle policies by risk band
Bands become frequencies through a cycle policy, which the chief audit executive sets and the audit committee approves. It is the most consequential planning decision in the function, because it fixes how much coverage is required before any engagement is chosen. A common version looks like the table below, although the details vary with the size of the function and the sector.
| Band | Typical frequency | Form of coverage | What it feels like from your side |
|---|---|---|---|
| High | Every year | A full engagement testing design and operation; continuous analytics where the data allows | An audit most years; monitoring in between |
| Medium | Every two years, or analytics yearly with a full engagement every third year | A focused engagement on the key risks | A shorter audit every other year; occasional data requests |
| Low | Every three to four years, or when triggered | A limited review, or reliance on management’s self-assessment with spot checks | Long gaps; an audit after a change or an incident |
| Mandatory, whatever the band | As required | Coverage required by law, regulation, lenders or the board | Predictable, calendar-driven testing |
| Continuous | Monthly or quarterly | Analytics over high-volume processes, with exceptions sent to process owners | Exception reports rather than audits |
Mandatory coverage is worth separating out because it is the least discretionary part of the plan. Companies subject to the Sarbanes-Oxley Act test key controls over financial reporting every year, and internal audit often does much of that testing. Banks in the United States arrange independent testing of their anti-money laundering programs at a frequency matched to their risk profile; the examination manual sets no required interval, and many banks test every twelve to eighteen months. Lenders sometimes require assurance over covenant reporting. If your area sits inside one of these programs, the timing of your audit is set by the program’s calendar, not by the risk assessment, and it will be much the same every year.
Triggers that bring an audit early
Plans change. Standard 9.4 expects the chief audit executive to review and revise the plan as the organization’s risks change, and most functions hold back a reserve of hours for exactly that purpose, often ten to fifteen percent of capacity. When something happens in an area, it can be added to the current year’s plan, moved forward, or dealt with through a smaller piece of work. The triggers are predictable.
| Trigger | Typical response | How soon |
|---|---|---|
| A fraud, theft or serious loss | Investigation of the event; an audit of the controls that failed, often across similar sites | Investigation at once; audit within months |
| A whistleblowing report | Investigation under the organization’s procedures; sometimes a targeted audit | Weeks |
| A new system or major upgrade | Advisory work during the project; a post-implementation audit | Before and three to six months after go-live |
| A reorganization or key-person departures | A review of whether controls survived the change | Within the year |
| An acquisition | A baseline review of the acquired business’s controls; integration audit | Within the first year after closing |
| New regulation | A readiness review before the effective date; compliance audit after | Months before and after |
| A regulator’s or external auditor’s concern | A targeted audit or follow-up | Often within the quarter |
| Exceptions from continuous analytics | Inquiry to the process owner; an audit if the pattern persists | Weeks to months |
| A request from management or the board | An advisory review or an added assurance engagement | By agreement |
| Validation of earlier findings | Testing that actions were implemented and work | At the action’s due date, in a validation window |
An incident in one location often brings an audit to all similar locations, which is one of the most common reasons a manager who has done nothing wrong finds the auditors at the door. A fraud at one branch, depot or store is evidence that the control design may be weak everywhere, and the audit that follows tests the design across the network. The site’s guide to what happens when internal audit finds fraud explains the first forty-eight hours of that kind of response.
How often by sector and size
The mechanics of planning are the same everywhere, but what gets audited every year, and what rotates, differs by sector. Regulated financial firms have the densest coverage and the most calendar-driven timing. Multi-site businesses rotate through locations. Small companies without a permanent function tend to commission audits around events.
| Sector or type | Usually covered every year | Usually on rotation | Common triggers |
|---|---|---|---|
| Banks and credit unions | Credit, anti-money laundering testing, IT security, treasury, regulatory reporting | Branches, back-office operations, smaller product lines | Supervisory findings, new products, incidents |
| Insurers | Claims, underwriting, reserving support, regulatory returns | Distribution channels, administration | Regulatory reviews, large claims, outsourcing changes |
| Listed companies | Key controls over financial reporting | Operational processes, subsidiaries | Restatements, acquisitions, control deficiencies |
| Manufacturers and distributors | Inventory, procurement, revenue | Plants, warehouses, depots | Shrinkage, safety incidents, new lines |
| Retailers and hospitality | Cash, inventory, payments | Stores, sometimes on unannounced visits | Losses, new formats, franchise changes |
| Public sector | Areas set by legislation and funding bodies | Departments and programs | Legislative changes, audit committee concerns |
| Nonprofits | Restricted funds, grant compliance | Programs, partners | Funder requirements, incidents |
| Small and growing companies | Often nothing, without a permanent function | Not applicable | Financing, sale, listing, a first external audit, a loss |
One source of confusion is worth clearing up. Organizations certified to management system standards such as ISO 9001 or ISO 14001 run “internal audits” of those systems at planned intervals, because the standards require them. Those audits are usually carried out by trained staff from other departments, check conformity with the management system, and follow the certification calendar. They are different from audits by the internal audit function, which report to the audit committee and cover risk and control across the organization. If your area is audited under both, the two schedules are set independently, although a well-coordinated organization will try to avoid putting them in the same month.
Size matters mostly through capacity. A large organization with a function of dozens of auditors can cover its High areas every year and its Medium ones on a two-year cycle. A mid-sized company with a function of four to six usually cannot, and its uncovered list is long. A company with no permanent function, or one outsourced to a firm for a few hundred hours a year, has audits when the board decides it needs one. If you are wondering why your area has not been audited in years, the answer is usually capacity, and the audit committee’s minutes will show that it knew. The site’s guide to internal audit in a small company covers the last case.
Signs an audit is coming
Planned audits are rarely a surprise to anyone who knows where to look. Most functions give two to four weeks’ notice before fieldwork, through a notification letter to the area’s executive and manager, and the signs are usually visible well before that. The site’s guide to the notification letter and kickoff shows what the formal notice contains.
- You were interviewed for the risk assessment, or your executive was, and the questions dwelt on your area.
- The plan was shared, in full or as a list of engagements, and your area is in it. Many functions publish the plan’s engagement list internally after committee approval.
- Your area had an incident, or a similar area elsewhere in the organization did.
- A system went live or a reorganization finished three to six months ago.
- Actions from your last audit are due, which brings validation testing even if no new audit is planned.
- You are part of a rotation: sites, branches or stores visited on a cycle, and your turn is due.
- The auditors ask for planning information: organization charts, procedures, key reports or data. This usually comes a few weeks before the notification.
- Exception reports from continuous analytics keep arriving about your area.
The exceptions to advance notice are deliberate. Cash counts, inventory counts and some compliance tests are done unannounced because notice would defeat the test, and investigations are not announced for the obvious reason. An unannounced cash count is a routine test in many cash-handling businesses, not a sign of suspicion about the person holding the cash.
What you can do about it
Managers have more influence over audit coverage than they think, but only through the front door. The risk assessment is designed to take management’s view into account, and an honest, specific account of your area’s risks is the most valuable input the auditors get. What does not work is trying to talk your area out of the plan, which is usually visible for what it is and tends to confirm that the area needs attention.
| What you do | Likely effect |
|---|---|
| Give a candid risk assessment interview: what worries you, what has changed, what is fragile | A better-targeted audit, often narrower, focused on the risks that matter |
| Share your own monitoring and its results | If it is reliable, auditors may rely on it and reduce testing; some models move the area down a band |
| Tell the auditors about problems you have found and are fixing | Credit in the report; some functions treat self-identified issues differently from ones they find |
| Ask for advice before a new system or process goes live | Problems designed out before an assurance audit finds them |
| Ask for an audit of something that concerns you | Independent evidence for your case, often valuable in budget discussions |
| Flag timing conflicts as soon as the plan is known | Fieldwork scheduled around the close, peak season or a go-live |
| Understate risks in the interview | Discovered later; damages the relationship |
| Lobby to be removed from the plan | Rarely works; draws attention |
| Delay reporting an incident until after the plan is set | The incident comes out anyway; the delay becomes a finding |
The more constructive way to think about it is that an area audited regularly with good results has the strongest possible evidence that it is well run, and an area that asks for advice early and fixes problems before they become findings tends, over time, to need less audit attention. The site’s guide to working with internal audit year-round covers that relationship, and the guide on why to welcome an internal audit covers what an area can get out of one.
If your area has been chosen
Once the notification arrives, the question changes from why to how. Three things are worth doing in the first week, before any request list lands. First, ask the audit lead what drove the selection: which risks the engagement is meant to address, what the objectives are, and whether an event or a request is behind it. The answer tells you where the auditors will spend their time, and most will share it readily. Second, read the last report on your area, if there was one, and check the status of every action from it, because validation of old findings is often folded into a new audit. Third, name one person as the audit contact and block time in your own calendar and theirs for the planning meeting, the requests and the closing meeting.
Everything after that is preparation, and the site has a guide for each stage: a month-by-month preparation plan, the PBC survival guide for the request list, and the guide to audit anxiety for the personal side, which for a first audit is often the hardest part.
Worked example: one company’s plan, from the areas’ side
MidState Beverage, the three-state drinks distributor used in this site’s examples, has twelve depots, 300 delivery routes, about 4,200 smaller customers who pay drivers in cash and checks, two recently acquired distributors not yet on its ERP, and a six-person internal audit function. Its FY27 plan, built step by step in the site’s guide to building an internal audit plan, has eight engagements. Here it is read from the other side: why each area was chosen, in terms the managers of those areas would recognize.
| Engagement | Band | Why this area, from its managers’ side | When |
|---|---|---|---|
| 1. Route cash handling, all twelve depots | High | About $31 million a year collected in cash and checks by drivers; a Dayton driver had diverted $18,400 over five months the year before; planning walkthroughs showed nine of twelve depots had no independent settlement reconciliation. Every depot was included because the weakness was in a design they all shared, not in any one manager. | Q1 |
| 2. Acquisition integration | High | Two acquired distributors on legacy systems, never audited, with an unknown control environment and as much change as any area could have | Q1 to Q2, later moved to Q3 at the CFO’s request |
| 3. ERP user access and segregation of duties | High | Roles unchanged since the 2013 route-accounting module; 38 users with administrative rights; suspected conflicts in depot roles | Q2 |
| 4. Warehouse inventory at the three largest depots | High | A $410,000 shrink write-off in FY26 and cycle counts unreconciled for two quarters at one depot | Q2 to Q3 |
| 5. Financial close | High | The controller and two of five accountants replaced during FY26; the close stretched to twelve days; three late adjustments over $100,000 | Q3 |
| 6. Support for financial reporting controls | Mandatory | A lender requirement and the board’s decision to prepare for external assurance over internal controls | All year |
| 7. Validation of fourteen open FY26 findings | Mandatory | Actions falling due, three of them already extended once | Q2 and Q4 |
| 8. Fleet and transport safety compliance (advisory) | Medium, plus a management request | 300 routes, a near-miss at a regulatory inspection in FY26 and no prior coverage; management asked for advice on its compliance monitoring before an assurance audit the following year | Q4 |
Beyond the eight engagements, the plan ran continuous analytics over payments, payroll, journal entries and route cash exceptions, and a rotation of limited reviews at the five depots the route cash audit did not visit. Just as instructive is the list of areas the plan did not cover. The sales commission scheme had never been audited and scored Medium, but management was redesigning it during the year, so the plan deferred it to audit the new scheme rather than the retiring one. Marketing and trade promotion spending, about $4.1 million a year and never audited, was deferred for lack of capacity. Treasury and human resources, both last audited in FY25 with stable processes, waited their turn. A manager in any of those areas who asked “why not us?” would have found the answer in the committee papers, with the reason, the interim mitigation and the year the audit is expected.
The depot managers’ experience of engagement 1 shows the point of this guide. Most of them read the notification as a response to the Dayton theft and wondered whether they were suspected. They were not. The plan had scored route cash as the highest risk in the company because of what it handled and how it was designed, and the Dayton case was evidence about the design. The site’s guide to what to expect during an internal audit follows one depot manager through that engagement.
Questions managers ask about being chosen
Why were we audited two years running?
Most likely your area sits in the High band, which many functions cover every year, or your earlier findings were due for validation, or an incident elsewhere brought an audit of similar areas. Ask the audit manager; the reason is usually in the plan.
We have never been audited. Is that good news?
Not necessarily. It usually means your area scored below the line in past years, or capacity ran out. Many scoring models move an area up a band when it has never been audited, so a first audit becomes more likely each year it does not happen.
Can I see the audit plan?
Many functions share the list of planned engagements with management after the audit committee approves it. The full plan, with scores and the uncovered list, is a committee document, but the chief audit executive can usually tell you whether and when your area is included.
Can I ask for my area to be audited?
Yes, and it is more common than people think. Managers ask for audits to get independent evidence for a budget case, to check a process they inherited, or to test a new system before it matters. The function will weigh the request against the plan and may offer an advisory review instead.
I have just taken over this area. Can I ask for an audit of what I inherited?
Yes, and it is one of the best reasons to ask. An audit early in your tenure records the state of the controls you inherited, gives you an independent list of what to fix, and makes it clear which problems predate you. Ask within your first few months, while the findings are plainly about the past.
Is an unannounced audit a sign of suspicion?
Usually not. Cash counts, inventory counts and some compliance checks are unannounced by design in many businesses, because notice would defeat the test. They are scheduled in the plan like any other work, and the person holding the cash on the day is simply the person on shift.
Does an audit mean someone complained about me?
Rarely. Almost all audits come from the plan or from events that affect a process, not a person. Complaints about individuals are handled as investigations, under different procedures, and the site’s guide to when internal audit interviews you explains the difference.
Related guides
- Being audited? — every guide for auditees and management, by stage of the audit.
- How to prepare for an internal audit — the month before fieldwork.
- What to expect during an internal audit — the engagement from notification to follow-up.
- How long an internal audit takes — timelines and what drives them.
- What internal audit can and cannot do — authority, access and limits.
- How to build an internal audit plan — the auditor’s side of this guide.
- The internal audit risk assessment — the scoring behind the plan.
- Building an audit universe — the list every plan starts from.
- Internal audit plan template — the document the committee approves.
- Living with internal audit year-round — making the next audit uneventful.
Leave a Reply