Risk-based auditing is the discipline of letting assessed risk, rather than the calendar, the org chart or the loudest executive, decide what internal audit looks at, how deeply and how often. It replaced two older ways of building an audit program: cyclical auditing, in which every unit is audited every N years regardless of what has changed, and compliance-based auditing, in which the plan is a list of rules to check. The Global Internal Audit Standards make the risk basis mandatory: Standard 9.4 requires a plan built on a documented assessment of the organization’s strategies, objectives and risks, with input from the board and senior management, reviewed and updated as needed. What the Standards do not do is tell a function how to score risk, how to turn scores into engagements, or how risk should change the work inside an engagement once it starts. That is this guide.
Risk operates at three levels, and functions that call themselves risk-based often apply it at only the first. At the plan level, risk decides which entities in the audit universe are audited this year and with how many hours. At the engagement level, risk decides which objectives, processes and controls inside the chosen entity get attention. At the testing level, risk decides how much evidence is enough: sample sizes, whether to test controls or balances, whether analytics over a full population replace sampling. This guide covers all three with a factor model, cycle rules and coverage arithmetic for the plan; the risk-to-control-to-test logic for the engagement; the reliance decision for testing; the triggers that reopen a plan; the relationship with management’s own risk assessment; the errors that turn the method into theater; measures; and a worked example from MidState Beverage’s FY27 plan. The plan guide shows the finished plan document, the risk assessment playbook the annual process in detail, and the engagement risk assessment guide the second level worked end to end.
In this guide
- What risk-based auditing is, and what it replaced
- The three levels where risk drives decisions
- Level one: the universe and the factor model
- Turning ratings into frequencies and hours
- Level two: risk inside the engagement
- Level three: risk and the depth of testing
- The annual method, step by step
- Risk-based auditing in a small function and in a regulated bank
- Keeping the plan risk-based during the year
- Using management’s risk assessment without being captured by it
- Errors that turn the method into theater
- Measures that show a function is risk-based
- A worked example: MidState’s 61 entities become eight engagements
- Questions about risk-based auditing
- Related guides
What risk-based auditing is, and what it replaced
The three approaches to building an audit program answer different questions. Cyclical auditing asks “when was this last audited?”; compliance-based auditing asks “what rules apply here?”; risk-based auditing asks “where could the organization be hurt, and how badly?” All three still exist, and the best plans borrow from the first two: a maximum interval between audits of any entity (so that nothing falls off the map), and mandated coverage where regulation requires it (SOX support, anti-money-laundering testing, data protection). But the organizing logic of a modern plan is risk, and the table shows why the profession moved.
| Approach | What decides the plan | Strength | Weakness | Where it survives |
|---|---|---|---|---|
| Cyclical | Elapsed time since the last audit | Complete coverage; predictable for auditees | Hours spent on low-risk areas; high-risk areas wait their turn; no response to change | As a maximum-interval rule inside risk-based plans (every entity at least every three to five years) |
| Compliance-based | The list of applicable rules and regulatory requests | Nothing mandated is missed | Audits what is regulated rather than what is risky; misses strategic and operational risk | As the mandated layer of a risk-based plan |
| Risk-based | Assessed likelihood and impact of harm, with velocity, change and control strength | Hours go where loss is likeliest; the plan speaks the board’s language | Depends on the quality of the assessment; can be gamed; needs updating | The organizing logic since the early 2000s; mandatory under Standard 9.4 |
The three levels where risk drives decisions
Each level has its own question, its own instrument and its own failure when skipped. A function that scores its universe carefully and then audits every chosen entity the same way, with the same twenty-five-item sample for every control, is risk-based at one level and cyclical at the other two.
| Level | Question | Instrument | Decision | Failure when skipped |
|---|---|---|---|---|
| Plan | Which entities, this year, with how many hours? | Audit universe, factor model, cycle rules | The engagements in the plan and their budgets | Hours spread evenly; the riskiest areas wait |
| Engagement | Within this entity, which risks and controls matter? | Engagement risk assessment; risk-to-control-to-test matrix | Objectives, scope, work program | Every engagement tests the same generic controls; the specific risk that made the entity high is never addressed |
| Testing | How much evidence is enough for this risk and this control? | Reliance decision; sample-size tables; analytics | Test type, population coverage, sample sizes | Twenty-five items for everything; weak controls tested as lightly as strong ones |
Level one: the universe and the factor model
The universe is the inventory of auditable entities, and the audit universe guide covers how to build one. The factor model is what scores each entity, and its design decides whether the plan is risk-based or merely looks it. A workable model has five to eight factors, each with an anchored scale (what a 1, 3 and 5 mean in words, not just numbers), weights that reflect what the organization fears, and a split between inherent factors (what could go wrong) and control factors (what stops it), so that a well-controlled high-inherent-risk area is distinguishable from a poorly controlled one. The table shows the model MidState Beverage adopted in FY26, which is typical of mid-size functions.
| Factor | Weight | Scale anchors (1 / 3 / 5) | Source |
|---|---|---|---|
| Financial exposure | 20% | Under $1M of annual flow or balance / $1M to $10M / over $10M | General ledger, budgets |
| Operational and strategic impact | 15% | Local inconvenience / disrupts a region or a month / threatens a strategic objective or the brand | Strategy, management interviews |
| Regulatory and legal exposure | 15% | No specific regulation / regulated with modest penalties / licensed, or penalties and sanctions severe | Compliance inventory |
| Fraud susceptibility | 10% | No cash or assets handled / some discretion or asset custody / cash, discretion and weak segregation | Fraud risk assessment |
| Complexity and change | 15% | Stable, simple / moderate change or complexity / new system, reorganization, acquisition or new leader in the last year | Project portfolio, HR |
| Control environment (reverse-scored) | 15% | Strong: recent clean audit, mature controls / mixed / weak: open high findings, no recent audit, known gaps | Prior audits, issue log, management self-assessment |
| Time since last audit and management concern | 10% | Audited within two years, no concerns / three years, or some concern / never audited, or concern raised by the board or management | Audit history, committee requests |
Weights are a statement of what the organization fears and should be approved by the audit committee, because a board that fears reputational harm more than financial loss will want the second factor heavier. Anchors are what make two auditors score the same entity the same way; the risk assessment matrix guide explains how to calibrate them and why unanchored scales produce a sea of 3s. The control factor is reverse-scored so that strong controls reduce the total, which is what turns inherent risk into the residual risk that should drive the plan; functions that score inherent risk only end up auditing their best-controlled areas because those have the largest flows.
Turning ratings into frequencies and hours
Scores are not a plan. Three rules convert them. The cycle rule maps rating bands to minimum frequencies: high-risk entities annually, medium every two years, low every three, with a maximum interval so that no entity is unaudited for more than, say, five years regardless of rating. The hours rule sizes each engagement by the entity’s complexity and the depth the rating demands, typically 250 to 400 hours for a medium-complexity process audit in a mid-size company and 500 to 800 for a high-complexity one. The capacity rule reconciles the demand those two rules create with the hours the function actually has, after planning, administration, follow-up, advisory, analytics and a reserve are set aside. When demand exceeds capacity, which it always does, the function documents what was deferred and why, and the committee decides whether to fund the gap or accept it; that conversation is the single most valuable product of a risk-based plan. The plan guide shows the capacity model line by line.
| Rating band (weighted score) | Minimum frequency | Typical hours per engagement | Share of a typical plan’s hours |
|---|---|---|---|
| High (3.8 to 5.0) | Every year | 400 to 800 | 50 to 65 percent |
| Medium (2.6 to 3.7) | Every two years | 250 to 450 | 25 to 35 percent |
| Low (1.0 to 2.5) | Every three years, or by rotation and analytics | 100 to 250, or covered by a thematic review | 5 to 15 percent |
| Mandated (any rating) | As required by regulation or the committee | As required | Fixed before the risk-based hours are allocated |
Level two: risk inside the engagement
An entity rated high because of one specific exposure deserves an engagement aimed at that exposure, and the engagement risk assessment is how the aim is set. The method: take the entity’s objectives, list what could stop each from being achieved (the risks), identify the controls management relies on against each, rate the inherent risk and the apparent control strength, and let the combination decide which controls are tested and how. A risk rated high with a control that looks weak gets a design review and a full operating test; a risk rated low with a strong control may get a walkthrough and no test at all. The product is a risk-to-control-to-test matrix, which the risk and control matrix guide templates and the engagement risk assessment guide works through for MidState’s warehouse inventory audit. Two disciplines keep level two honest: the engagement risk assessment is written before the work program, not reverse-engineered from it, and it records the risks the team chose not to pursue, so that a later question (“why didn’t you look at X?”) has an answer.
Level three: risk and the depth of testing
The third level is where most functions stop being risk-based without noticing. The question is how much evidence is enough, and the answer depends on the risk and on how much the auditor can rely on controls. Where controls are well designed and tested effective, the auditor needs less substantive evidence about the underlying transactions or balances; where controls are weak or untested, more. The sample-size tables encode this: in attribute sampling, a control the team is relying on heavily, with a low tolerable deviation rate, needs a larger sample than one relied on lightly (the attribute sampling guide gives the tables); in monetary unit sampling, higher assessed risk means a lower confidence factor is unacceptable and the sample grows (the MUS guide shows the arithmetic). Analytics changes the equation: where the data exists, testing the whole population for a specific condition (every override approved by its raiser, every payment to a vendor created in the last thirty days) gives more assurance than any sample, at lower cost, and shifts the sample to the exceptions. The sample sizes guide explains why the 25-40-60 rule of thumb is a floor, not a method, and the test exceptions guide covers what to do when risk turns out higher than assessed mid-test.
| Assessed risk of the control failing | Reliance planned | Typical approach | Attribute sample (95% confidence, 0 expected deviations) |
|---|---|---|---|
| Low (strong design, clean history, automated) | High | Walkthrough plus a small operating test, or a test of the automated control once with change-control evidence | Test of one for automated controls; 25 for manual controls at a 10 percent tolerable rate |
| Medium | Moderate | Operating test over the period; analytics where data allows | About 45 at a 6 to 7 percent tolerable rate |
| High (weak design, open findings, manual, high volume) | Low or none | Full-population analytics for the condition; larger samples; substantive testing of outcomes | About 60 at a 5 percent tolerable rate, or the full population by analytics |
| Any, where fraud is a stated risk | None on the control alone | Targeted selection of high-risk items plus the statistical sample; confirmation with third parties | Statistical sample plus a judgmental layer |
The annual method, step by step
The plan-level work follows a sequence that takes a mid-size function six to ten weeks of elapsed time each autumn, with most of the effort in the interviews and the scoring. The table gives the steps, the owner, the output and the typical effort; the risk assessment playbook gives templates for each.
| Step | Owner | Output | Effort (six-person function) |
|---|---|---|---|
| 1. Refresh the universe against the ledger, the system inventory, the org chart and the project portfolio | Audit manager | Updated entity list with owners | 2 to 3 days |
| 2. Gather inputs: strategy, ERM register, incident and hotline logs, prior findings, external audit and regulator letters | Senior auditor | Input pack per entity | 3 to 4 days |
| 3. Interview the executive team and key managers on what worries them and what has changed | CAE and audit manager | Interview notes; emerging-risk list | 15 to 25 interviews, 2 weeks elapsed |
| 4. Score every entity on the factor model, two scorers independently, reconcile differences | Whole team | Scored universe with rationale per factor | 3 to 5 days |
| 5. Apply the cycle rule and the hours rule to produce demand | Audit manager | Demand schedule by entity | 1 day |
| 6. Build the capacity model and reconcile; list deferrals with reasons | CAE | Draft plan, deferral list, resource gap | 2 days |
| 7. Review with senior management for input (not approval) and adjust | CAE | Revised draft; management comments logged | 1 week elapsed |
| 8. Present to the audit committee with the methodology, the heat map, the deferrals and the gap; obtain approval | CAE | Approved plan; minutes recording the deferral decision | Committee meeting |
Two scorers per entity in step 4 is the single practice that most improves a model, because the reconciliation conversation exposes unanchored scales and hidden assumptions; functions too small for two scorers substitute a written rationale per factor that a reviewer can challenge.
Step 7 is where independence is tested. Management’s input improves the plan (they know what changed), but a plan management approves is not independent, and the Standards are specific that the board approves. The committee pack for step 8 should show the method (factors, weights, anchors), the distribution of ratings, the engagements chosen and why, what was deferred and the risk accepted by deferring it, and the resource gap in hours and money. A committee that sees only the list of engagements cannot judge whether the plan is risk-based; one that sees the deferrals can.
Risk-based auditing in a small function and in a regulated bank
The method scales down and up. A one-person function runs the same eight steps in two weeks with a universe of thirty entities, five factors, a single scorer who documents rationale (because there is no second scorer to reconcile with) and a plan of six to eight engagements; the discipline that matters most is the written deferral list, because a solo auditor’s capacity gap is enormous and the committee must own it. The year-one plan guide shows the first version of such a plan when there is no audit history to score against.
A regulated bank runs the same method with three additions. Supervisors expect the universe to cover every significant business line, risk type and legal entity, and will compare it with their own risk assessment of the institution; the bank audit universe guide shows a 126-entity example with the cycle applied. Mandated coverage is larger: independent testing of the anti-money-laundering program, model risk, liquidity and capital stress testing, and regulatory reporting carry supervisory expectations about frequency that sit above the risk model. And the control-environment factor must reflect open supervisory findings, because an entity with an unresolved matter requiring attention is high-risk by definition until the finding is validated closed. The internal audit in banking guide covers the supervisory expectations in full.
Keeping the plan risk-based during the year
A plan approved in December reflects December’s risks. Standard 9.4 requires the plan to be reviewed and updated as needed, and a function that never changes its plan is announcing that nothing happened all year. Four mechanisms keep it live. A reserve, typically 10 to 20 percent of hours, exists to be spent on what emerges; MidState’s FY27 reserve of 960 hours funded a 540-hour cyber program audit after a near-miss. A quarterly re-scoring of the universe against a short list of triggers (new system, new leader, reorganization, regulatory change, incident, hotline cluster, external event in the sector) moves entities between bands. A committee protocol states who approves a change: the chief audit executive for swaps within the reserve, the committee for anything that defers a planned high-risk engagement. And a change log records every change with its reason, which is what the external assessor and the examiner will ask for. The KRI program guide shows how a function’s own indicators can feed the triggers.
Using management’s risk assessment without being captured by it
Most organizations with an enterprise risk management program have a register, an appetite statement and a heat map, and the Standards expect the function to understand and use them (9.1). The trap is adopting them as the audit risk assessment. Management’s register records the risks management perceives, rated by management, at the level of the organization’s objectives; the audit universe needs risk at the level of auditable entities, rated independently, including the risks management does not perceive or prefers not to record. The sound practice is to use the register as one input (a factor, or an overlay that lifts an entity’s rating when it owns a top-ten enterprise risk), to reconcile the two views and investigate the differences, and to treat the ERM program itself as an auditable entity, which the auditing the ERM program guide covers. Where the audit function’s risk assessment and management’s agree on everything, one of them is not doing its job. The risk register and taxonomy guides explain the instruments the function is reading.
Errors that turn the method into theater
The method fails in predictable ways, and most failures are visible in the committee pack if anyone looks. The list below is drawn from external quality assessments and examiner findings about audit plans; each item is a question the committee can put to the chief audit executive.
Scoring without anchors, so that every entity lands at 3 and the plan is really built on the chief audit executive’s instinct with a spreadsheet for cover. Scoring inherent risk only, which steers the function toward the largest, best-controlled processes. Letting the universe go stale, so that the new subsidiary, the new cloud platform and the new sales channel are not on the list to be scored. Building a plan that exactly matches capacity, which means the risk assessment was fitted to the budget rather than the budget to the risk. Never deferring anything high, because deferral is uncomfortable to report, so the plan is padded with half-length engagements that find nothing. Auditing what is measurable (finance, IT) and leaving what is risky but soft (culture, strategy execution, third parties) unscored. Treating the engagement level as a formality, so every audit tests the same twelve generic controls. And the quietest error: never changing the plan in-year, because the committee approved it and change looks like failure, when under the Standards change is the evidence that the function is watching.
Measures that show a function is risk-based
“We are risk-based” is a claim every function makes and few can evidence. The evidence is numerical and comparative: hours and findings by rating band, the state of the universe, and the record of change. A function that cannot produce these numbers from its own records within a day is not managing the plan as a risk instrument.
A committee can test the claim with six numbers, reported annually and tracked over time; the KPI guide adds the rest of the scorecard.
| Measure | What it shows | Healthy range |
|---|---|---|
| Share of high-rated entities audited in the year | Whether the cycle rule holds where it matters | 90 to 100 percent; every exception explained |
| Share of plan hours on high-rated entities | Whether hours follow risk | 50 to 65 percent |
| Entities beyond the maximum interval | Whether the floor holds | Zero, or a named list with reasons |
| In-year plan changes with documented triggers | Whether the plan is live | Three to eight changes a year in a mid-size function; zero is a warning |
| Findings rated high per 100 hours, by entity rating band | Whether the model predicts where problems are | Higher in high-rated entities; if flat across bands, the model is not discriminating |
| Universe refresh completeness | Whether new entities are being captured | Universe reconciled to the general ledger, the system inventory and the org chart annually |
A worked example: MidState’s 61 entities become eight engagements
MidState Beverage, the three-state drinks distributor with a six-person audit function, rebuilt its universe in FY26 to 61 auditable entities across twelve depots, the ERP and route-accounting systems, finance, HR, fleet, procurement and two unintegrated acquisitions. Scored on the model above, 14 entities rated high, 23 medium and 24 low. The cycle rule produced demand for about 7,900 hours against a capacity, after follow-up, analytics, depot rotations and reserve, of about 4,300 engagement hours. The chief audit executive took that gap to the committee with a list of what would be deferred, and the committee funded a 140-hour co-source for ERP access testing and accepted the deferral of three medium-rated entities to FY28.
The eight engagements that resulted, with their hours, show the model at work. Route cash (520 hours) scored 4.6: $31 million of driver-collected cash, weak segregation at depots, no audit in four years. The acquisition integration (750) scored 4.4 on change and complexity. ERP user access (550 plus 140 co-sourced) scored 4.2: 412 users and 74 roles for 31 jobs. Warehouse inventory (650) scored 4.1 after a $410,000 shrink write-off. Financial close (550) and ICFR support (900, mandated by lenders and the board) followed, with the validation of fourteen open findings (450) and a fleet and DOT advisory (300) that management requested. Inside the engagements, level two steered the work: the route cash risk assessment put the hours on reconciliation independence and override approval rather than on the cash-count procedures the previous audit had tested, and level three turned the override risk into a full-population analytic (1,412 of 37,400 overrides approved by their raiser) rather than a sample of forty. The plan guide prints the whole document; the report anatomy guide shows what the route cash audit found.
Questions about risk-based auditing
What is risk-based internal auditing?
An approach in which assessed risk decides what internal audit examines, how often, how deeply and with what testing, instead of a fixed cycle or a list of rules. It operates at three levels: the annual plan, the scope of each engagement and the depth of testing.
Is a risk-based audit plan required by the Standards?
Yes. Standard 9.4 of the Global Internal Audit Standards requires the plan to be based on a documented assessment of the organization’s strategies, objectives and risks, with input from the board and senior management, and to be reviewed and updated as needed.
What risk factors should an audit risk assessment use?
Typically five to eight: financial exposure, operational and strategic impact, regulatory exposure, fraud susceptibility, complexity and change, control environment (reverse-scored) and time since the last audit or management concern, each with anchored scales and weights approved by the audit committee.
How often should high-risk areas be audited?
Most functions audit high-rated entities every year, medium every two years and low every three, with a maximum interval of three to five years for any entity regardless of rating, and with continuous analytics covering some areas between audits.
What is the difference between the audit risk assessment and management’s risk register?
The register records the risks management perceives, at the level of organizational objectives, rated by management. The audit risk assessment rates auditable entities independently, uses the register as one input, and includes risks management has not recorded. The two should be reconciled, not merged.
How does risk change the testing inside an audit?
Higher risk and weaker controls mean more evidence: larger samples, lower tolerable deviation rates, full-population analytics where data exists and substantive testing of outcomes. Lower risk with strong controls allows reliance on a walkthrough and a smaller operating test.
Should the audit plan change during the year?
Yes. A reserve of 10 to 20 percent of hours, quarterly re-scoring against triggers, a protocol for who approves changes and a change log keep the plan risk-based; a plan that never changes suggests the function is not watching.
Related guides
- How to build the internal audit plan — MidState’s FY27 plan in full, with the capacity model.
- The annual risk assessment playbook — the process behind the plan.
- How to build an audit universe — the inventory the model scores.
- A bank audit universe worked example — 126 entities rated and cycled.
- Risk assessment matrix — anchored scales and calibration.
- Engagement-level risk assessment — level two worked end to end.
- Risk and control matrix template — the risk-to-control-to-test instrument.
- Attribute sampling — sample sizes that follow risk.
- Monetary unit sampling — risk and the confidence factor.
- Audit sample sizes: 25, 40, 60 — why the rule of thumb is a floor.
- Handling test exceptions — when risk turns out higher than assessed.
- The risk register — management’s instrument, read critically.
- Auditing the ERM program — assuring the second line’s risk assessment.
- Designing a KRI program — indicators that feed plan triggers.
- Internal audit plan template — the document.
- Internal audit KPIs — the scorecard.
- The Global Internal Audit Standards — Standard 9.4 in context.
Leave a Reply