A year-one audit plan is the first annual plan of a newly established internal audit function, built for an organization in which nothing has been audited internally before, by a team that does not yet know the business, for a board that does not yet know what the function will produce. It differs from every later plan in three ways: the risk assessment behind it rests on interviews and documents rather than on audit history, so it is less reliable; the function’s credibility is still to be earned, so what the plan produces matters as much as what it covers; and the organization’s tolerance for being audited is untested, so where the plan goes first shapes whether the second year is welcomed or resisted. The textbook answer, audit the highest risks first, is right in principle and usually wrong in sequence, because the highest-risk area in a new function’s universe is often the one where the function has the least standing and the least knowledge.
This guide gives the sequencing wisdom. It covers the foundation audits that map the terrain and teach the function the organization, the early wins that build credibility with evidence, the political minefields to defer until the function has standing and how to defer them without hiding them, sizing the plan for a team that is still learning, the hours a first year actually has, presenting the plan so that the committee understands what is not covered and accepts it on the record, the traps that sink first plans, and three example year-one plans for a private manufacturer, a newly public software company and a community bank. It follows the first 90 days guide, which gets a new chief audit executive to the point of having a universe, and precedes the one-person shop manual for functions that start at one; the plan guide covers the mechanics every plan shares.
In this guide
- Why the first plan is different
- Inputs when there is no audit history
- Foundation audits: mapping the terrain
- Early wins: credibility from evidence
- Political minefields: defer without hiding
- Sizing: fewer, better, finished
- The hours a first year actually has
- A sequencing framework
- Presenting the plan to the committee
- Template: the year-one plan summary page
- Traps that sink first plans
- Example plan 1: a private manufacturer (Brightwater Foods)
- Example plan 2: a newly public software company
- Example plan 3: a community bank
- What year two inherits
- Questions about year-one audit plans
- Related guides
Why the first plan is different
| Dimension | Established function | Year-one function | Implication for the plan |
|---|---|---|---|
| Risk assessment basis | Audit history, incident data, prior findings | Interviews, documents, management’s own view | Ratings are provisional; the plan should include engagements that test them |
| Knowledge of the business | Deep | Shallow | Early engagements double as learning; scope them to teach |
| Credibility | Earned | Nil | What the first reports look like matters as much as what they cover |
| Organizational tolerance | Known | Untested | Where the function goes first shapes how it is received later |
| Methodology and templates | In place | Being written | The first engagements build the templates; budget for it |
| Relationships | Established | Forming | The plan is also a schedule of introductions |
| Committee expectations | Calibrated | Often unrealistic in either direction | The plan presentation sets them |
Inputs when there is no audit history
With no findings to draw on, the first risk assessment rests on what the listening tour produced (where executives and managers say things break), on documents (the strategy, the risk register if one exists, incident and complaint records, the external auditor’s management letters and any regulatory correspondence, the insurance claims history), on data the function can pull quickly (volumes by process, exceptions, write-offs, adjustments), and on the structural facts a new auditor can see in a week: single points of failure, acquisitions not integrated, systems past their life, functions with one person in them. The risk assessment method applies with a smaller factor set and an honest statement that the ratings are provisional; the universe is built at coarse granularity (30 to 60 entities for a mid-size organization) because the function cannot yet tell where the finer lines fall. The committee’s own view is an input, not an instruction: a chair who wants the plan to start with the area that worries the board is giving the function information about the board’s risk perception, which the plan should address, and about politics, which it should weigh.
Foundation audits: mapping the terrain
| Foundation engagement | Why first | What the function learns | Guide |
|---|---|---|---|
| Entity-level controls and governance | Shows whether the organization’s control environment can support process controls at all; introduces the function to every executive | Who decides what; where policies exist and where they are folklore; the board’s real oversight | Entity-level controls |
| User access to the core systems | Universal, objective, data-driven; findings are hard to argue with; access underlies every other control | The systems, their owners, the leaver process, the administrators, how much the organization relies on a few people | User access review; IAM audit |
| The financial close | Touches every process’s output; the CFO cares; the external auditor’s letters give a head start | The accounting systems, the manual journal culture, the reconciliations, the spreadsheets | Financial close |
| The core process (what the business does to earn money) at one site or unit | Teaches the business; produces the function’s first operational findings; scoped to one unit so it finishes | How the product moves, where cash and inventory are exposed, who the operators are | Order to cash; procure to pay; inventory |
| Purchase-to-pay analytics | Full-population, cheap, finds recoverable money (duplicates, unverified vendors) in most organizations | The vendor base, the payment controls, the data quality | AP analytics |
Foundation audits are chosen because they teach the function the terrain while producing defensible findings, not because they are the highest risks; a year-one plan of three to four foundation engagements and one or two risk-driven ones is the common shape. The entity-level engagement is the most often skipped and the most valuable: a function that discovers in year three that the organization has no delegation of authority and no policy framework has spent two years auditing processes whose controls were never going to hold.
Early wins: credibility from evidence
Credibility in year one comes from findings that are specific, evidenced, agreed by their owners and fixed, and from the money and risk they demonstrably address. The engagements that produce such findings fastest share three features: a population the function can test in full or sample objectively (payments, access, payroll, expenses), criteria nobody disputes (policy, law, the organization’s own procedures), and an owner who benefits from the finding being fixed. Duplicate and unverified vendor payments, leaver access still active, payroll paid after termination, expense policy breaches by the senior population and uncollected receivables are the classic early wins, and the AP, payroll and travel and expense guides show the tests. The win is not the finding but the fix: a recovered $47,000 and a closed leaver process are what the committee remembers, and the life of a finding guide explains why the function should track and report the fixes as carefully as the findings in its first year.
Political minefields: defer without hiding
| Minefield | Why it is dangerous in year one | What to do instead |
|---|---|---|
| The chief executive’s pet project or division | Findings will be read as an attack; the function lacks the standing to survive the reaction | Cover the division’s transactional processes (access, payments) in a foundation audit; schedule the strategic review for year two with the chair’s backing |
| A function whose head sponsored internal audit’s creation | Gratitude and dependence compromise objectivity; a hard finding ends the relationship the function still needs | Audit it in year two, after the function reports to the committee in fact and not only on paper |
| Executive compensation and expenses | Powerful auditees; findings embarrass the board | Include the senior population in the expense analytics with the chair’s prior knowledge; report privately first |
| Culture | Judgment-heavy; the function has no baseline and no credibility for soft findings | Gather culture evidence in every engagement; a culture audit in year two or three (the culture guide) |
| Strategy and major decisions | Requires business knowledge the function does not have | Defer; note in the plan presentation as the year-two priority |
| A live crisis or investigation | The function is drawn in without a protocol or standing | Agree the investigation protocol with counsel before anything happens; support, do not lead, in year one |
Deferring is not hiding. The plan presentation names the deferred areas, their risk ratings and the year they are scheduled, so that the committee has decided to wait rather than discovering later that the function avoided them. A deferred area that produces a loss in year one is a committee decision; a hidden one is the function’s failure.
Sizing: fewer, better, finished
A first-year team works slower than it will: it is writing templates as it goes, learning systems, building relationships and discovering that every engagement needs a walkthrough of a process nobody has documented. Engagements take 30 to 50 percent longer than the same team will take in year three, and the plan should budget accordingly: five to seven engagements for a function of two or three people, four to five for one person, with 20 percent of capacity held in reserve for the requests a new function receives from executives testing what it is for. Every engagement is sized to finish inside a quarter, because a first-year engagement that drags across two quarters loses its owner’s attention and the function’s momentum. The committee is told the sizing logic, because a committee that expected twelve audits and received six will judge the function a failure unless it approved six, and a chief audit executive who delivers six of six approved has a record while one who delivers six of twelve has an excuse; the plan guide’s capacity model is where the arithmetic is shown.
The hours a first year actually has
| Use of time | Function of one | Function of three | Note |
|---|---|---|---|
| Gross hours | 2,080 | 6,240 | |
| Leave, holidays, administration | −380 | −1,140 | Standard |
| Methodology, templates, tools setup | −200 | −350 | Year-one specific; the manual and templates |
| Universe, risk assessment, plan | −150 | −250 | Heavier in year one |
| Committee, board, charter work | −150 | −200 | The charter and the committee relationship |
| Listening tour and relationship building | −120 | −200 | Year-one specific |
| Training and professional activity | −100 | −300 | Standards, systems, the business |
| Reserve for requests and investigations | −200 | −600 | 20 percent of what remains |
| Available for planned engagements | About 780 | About 3,200 | Four engagements of 150 to 250 hours; or ten to twelve of 250 to 350 |
The table is the honest version of a year-one capacity, and it is usually about 60 percent of what the same team will have in year three. Co-source hours add to the available line for the engagements the team cannot perform (technology, specialist areas), as the co-sourcing guide describes, and should appear in the plan as hours and dollars the committee approves.
A sequencing framework
| Quarter | Engagement type | Purpose | Typical choice |
|---|---|---|---|
| First | Foundation: data-driven, universal | Learn the systems; produce objective findings fast; first report to the committee within the quarter | User access to core systems; purchase-to-pay analytics |
| Second | Foundation: governance | Understand the control environment; meet every executive with a purpose | Entity-level controls and policy framework; or the financial close |
| Third | Core process, one unit | Learn the business; first operational findings | The main revenue or production process at one site |
| Fourth | Risk-driven, specialist, often co-sourced | Address the committee’s top concern with the standing now earned; buy skills the team lacks | Cyber resilience; third-party; the regulatory program |
| Throughout | Validation and reserve | Track and validate every action from the first engagements; absorb requests | The issue log; the validation discipline |
The framework is a default, not a rule. A function created because of a crisis (a fraud, a regulatory action) starts with the crisis area because the committee’s question cannot wait, and the pre-IPO readiness guide describes the version in which SOX deadlines dictate the first year. What the framework protects is the principle that the function should know the organization before it judges its strategy, and should have fixed something before it criticizes anyone powerful.
Presenting the plan to the committee
The year-one plan presentation sets the committee’s expectations for years, and it should contain five things the plan template carries: the universe and its provisional ratings, with the statement that they are provisional and will be tested; the engagements chosen, with the reason for each in terms of the framework above (foundation, early win, risk-driven); the areas not covered and the areas deliberately deferred, with their ratings and the year they are scheduled; the capacity arithmetic and the co-source budget; and the measures by which the committee should judge the year (engagements completed as planned, findings agreed and fixed, the first conformance statement). The committee approves the plan and, in the same decision, the gaps, which the annual agenda guide places in the fourth-quarter meeting with the charter‘s approval clause behind it. The presenting to the committee guide covers the delivery; the first-year specific point is to under-promise in writing, because the function will be judged against the document.
Template: the year-one plan summary page
Internal audit plan, year one, [organization]. Universe: [61] auditable entities, rated provisionally on [three] factors from interviews, documents and data; ratings to be tested by the year’s engagements and refined for year two. Capacity: [1,150] in-house productive hours and [400] co-sourced hours within a budget of [$]; reserve [180] hours for requests and investigations. Engagements: [five], listed with quarter, hours, type (foundation, early win, risk-driven, mandated) and the reason for each. Coverage: [the entities covered, their ratings]; high-risk entities not covered this year: [list with ratings], scheduled for [year two] and accepted by the committee as an open risk for the year. Deferred areas and reasons: [strategy and major decisions: knowledge; the finance function: standing; culture: baseline], scheduled for [year two or three]. Co-source: [firm, scope, hours, cost, the function’s scoping and review role]. Methodology: templates in place; manual by [month four]; first quality self-assessment with the annual report. Measures for the year: engagements completed as planned; findings agreed and actions validated; the first conformance statement; committee satisfaction. Approval: [committee, date]; gaps acknowledged in the same decision.
Traps that sink first plans
| Trap | How it happens | Avoidance |
|---|---|---|
| The textbook universe | 120 entities and twelve engagements copied from a larger organization’s plan | Coarse universe; five to seven engagements; reserve |
| Starting with strategy | The board’s biggest worry audited first by a team that does not know the business | Foundation first; the strategic review in year two with standing |
| Auditing the sponsor | The CFO who created the function receives its first hard report | Defer; report to the committee in fact first |
| No early win | Three governance reviews and no recovered money or fixed control | One data-driven engagement in the first quarter |
| Engagements that do not finish | Scopes too wide; reports issued two quarters late | Size to finish inside a quarter; narrow scope |
| Findings not fixed | Reports issued; actions untracked; year two finds the same things | Issue log from day one; validation in the plan |
| Hidden deferrals | Difficult areas left out without telling the committee | Deferred areas named with ratings and dates |
| Methodology written after the engagements | Files inconsistent; the first quality review fails | Templates before the first engagement; the manual by month four |
| Co-source drives the plan | The firm proposes what it sells | The function scopes; the firm delivers |
Example plan 1: a private manufacturer (Brightwater Foods)
Brightwater Foods is a $180 million food manufacturer with three plants and about 600 staff, used in examples across this site, whose board formed an audit committee and hired a first chief audit executive who worked alone in year one with a co-source firm, as the solo shop manual recounts. The universe had 61 entities; capacity was about 1,150 in-house hours plus 400 co-sourced.
| Quarter | Engagement | Type | Hours | Why it was chosen |
|---|---|---|---|---|
| First | Procure-to-pay analytics across all plants | Foundation; early win | 220 | Full-population, objective; found duplicates and unverified vendors; taught the function the ERP and the vendor base (the first run) |
| Second | Cyber resilience review (co-sourced, scoped and reviewed by the CAE) | Risk-driven; committee’s top concern | 250 co-source + 60 | The board’s stated worry; the firm had the skills; findings (41-hour restore against a 24-hour target) funded the backup program |
| Second to third | Planned maintenance at the three plants | Core process, operational | 280 | Taught the plants; criteria set with operations (the criteria guide); produced the first operational findings plant managers accepted |
| Third | Third-party resilience: continuity-critical suppliers | Risk-driven; co-sourced in part | 150 co-source + 120 | Followed from the cyber review’s dependency findings; found the sole-source closure supplier |
| Fourth | Business continuity program | Foundation for resilience; governance | 300 | Pulled the two resilience reviews into a program finding; set up year two’s BIA and exercise agenda |
| Deferred to year two | Entity-level controls and policy framework; technology general controls; sales and customer concentration; HR | Named in the plan with ratings; the committee accepted the gap on the record |
The plan broke the framework in one respect, deferring the entity-level engagement to year two, because the CAE judged that the charter and committee work of the first six months was itself the governance review and that the board’s concern about cyber could not wait; the plan presentation said so. Five of five engagements finished, every action tracked, and the second auditor was funded on the strength of the year.
Example plan 2: a newly public software company
The newly listed software company described in the pre-IPO readiness guide built its internal audit function in the year of its listing, with a head of internal audit and two auditors hired from external audit, a SOX program already run from finance with consultants, and a universe shaped by the listing’s deadlines: the first 404(a) assessment with the second annual report and the NYSE’s internal audit requirement. Capacity was about 3,000 in-house hours plus 500 co-sourced.
| Quarter | Engagement | Type | Hours | Why it was chosen |
|---|---|---|---|---|
| First | User access and segregation of duties in the ERP and the production platform | Foundation; data-driven | 350 | Underlies SOX ITGCs; objective; introduced the function to engineering |
| First | Entity-level controls and the policy framework | Foundation; governance | 300 | The listing created the committees and policies; the function tested whether they operated |
| Second | Revenue recognition and order-to-cash controls | Core process | 450 | The highest financial reporting risk for a software company (the guide); coordinated with the SOX program so controls were tested once |
| Second to third | SOX program quality: independent assessment of the consultants’ control matrices and testing | Risk-driven; assurance over management’s program | 400 | The committee needed an independent view of a 412-control matrix before the first assessment; internal audit assessed rather than performed the testing, preserving independence |
| Third | Cloud security and change management (co-sourced) | Risk-driven; specialist | 500 co-source + 150 | The product runs in the cloud; the cloud program and pipeline guides |
| Fourth | Equity compensation and payroll | Early win; sensitive population | 300 | Stock administration errors are common after listing; the chair knew in advance that executives were in the population |
| Fourth | Vendor management and spend analytics | Early win; data-driven | 300 | Recoverable money; the vendor base had doubled |
| Deferred | Sales compensation; data privacy; strategy and M&A; customer success operations | Named with ratings; privacy scheduled for year two with a specialist |
Example plan 3: a community bank
A $1 billion community bank that had outsourced internal audit entirely for a decade hired an in-house audit manager and a staff auditor, keeping the outsourcing firm for BSA/AML independent testing and technology work, after examiners observed that the board’s oversight of the outsourced function was thin. The universe, built from the firm’s prior coverage and the bank universe example, had 54 entities; the banking guide‘s regulatory commitments fixed about 40 percent of the hours before any choice was made.
| Quarter | Engagement | Type | Hours | Why it was chosen |
|---|---|---|---|---|
| Throughout | Regulatory issue validation and examination support | Mandated | 300 | Open matters from the last examination; the function’s first task was to validate what the firm had reported closed |
| First | BSA/AML independent testing (outsourced, scoped and reviewed in-house) | Mandated; specialist | 400 outsourced + 60 | Annual requirement; the in-house team learned the program by reviewing the firm’s work (the test) |
| First | User access to the core banking system and wire platform | Foundation; data-driven | 250 | Objective; examiners always look; found leaver access and shared administrator credentials |
| Second | Wire transfer and ACH operations | Core process; highest-velocity risk | 300 | The bank’s largest fraud exposure; the payment operations program; findings on callback procedures |
| Second to third | Commercial lending: origination and servicing at one region | Core process; learn the business | 400 | The largest asset; scoped to one region to finish; coordinated with credit review |
| Third | FDICIA support and financial close | Mandated; foundation | 300 | Part 363 requirements; the external auditor’s reliance discussion |
| Fourth | Board and committee governance; vendor management program | Governance; risk-driven | 250 | The examiners’ observation on oversight; the third-party program examiners test |
| Deferred | Deposit operations; mortgage; interest rate risk and ALM (outsourced firm in year two); trust | Named with ratings and the regulatory cycle expectation stated |
The bank plan shows the regulated version of the framework: mandated and validation work first because it is not optional, foundation access work alongside it, the core process (lending) at one region, and the governance engagement answering the examiners’ observation in the fourth quarter when the function had standing. The three plans differ in content and agree in shape: foundation and early wins before judgment, deferrals named, everything sized to finish, and in each the fourth quarter’s engagement was the one the committee had wanted first.
What year two inherits
A year-one plan done well leaves year two four things: a universe whose ratings have been tested by engagements and can be refined to finer granularity; a methodology and templates that exist because the first engagements needed them; relationships with every executive, formed through foundation audits rather than through confrontation; and an issue log with validated fixes that gives the function its first evidence of value. It also leaves the deferred list, which becomes year two’s risk-driven core: the strategic review, the sponsor’s function, culture, the areas that needed standing. The KPI guide‘s first-year measures (plan completion, findings fixed, committee satisfaction) are the record the function carries into the second plan presentation, and the Domain I purpose statement is the test of whether the first year produced what the function exists for: assurance, advice, insight and foresight the board did not have before.
Questions about year-one audit plans
What should a new internal audit function audit first?
Foundation areas that teach the function the organization and produce objective findings: user access to core systems, purchase-to-pay analytics, entity-level controls and the financial close, then the core business process at one unit, with the committee’s top risk-driven concern in the fourth quarter when the function has standing and can buy the skills.
How many audits should a first-year plan include?
Four to five for a function of one, five to seven for two or three people, each sized to finish inside a quarter, with 20 percent of capacity in reserve. First-year engagements take 30 to 50 percent longer than they will later.
Should the first audit be the highest risk?
Usually not first. The highest risk is often strategic or political, where a new function lacks knowledge and standing; it belongs in the fourth quarter or year two, named in the plan with its rating so the committee decides to wait rather than discovering the function avoided it.
How do I handle areas I am deferring?
Name them in the plan presentation with their provisional ratings and the year they are scheduled, and have the committee approve the gap in the same decision as the plan. Deferring openly is a committee decision; deferring silently is the function’s failure.
What is an early win and why does it matter?
A finding that is specific, evidenced, agreed by its owner and fixed, typically from a data-driven engagement over payments, access or payroll, that demonstrably recovers money or closes a risk. It is what gives the function the credibility to audit harder areas later.
How does a regulated company’s first plan differ?
Mandated work (regulatory validation, BSA testing, FDICIA or SOX support) fixes a large share of hours before any choice is made, and examiner expectations shape the cycle; the framework still applies to the discretionary hours, with foundation work alongside the mandated items.
When should the methodology be written?
Templates before the first engagement and the manual within the first four months, budgeted as year-one hours. Writing the methodology after the first engagements produces inconsistent files and a failed first quality review.
Related guides
- Your first 90 days as chief audit executive — getting to the universe.
- The one-person internal audit shop — the solo version of the first year.
- How to establish an internal audit function in a small company — the founding steps.
- How to build the internal audit plan — the capacity model.
- Internal audit plan template — the document the committee approves.
- Building the audit universe — coarse first, finer later.
- The annual internal audit risk assessment — provisional ratings in year one.
- The internal audit methodology manual — templates before the first engagement.
- Entity-level controls — the governance foundation audit.
- User access review — the data-driven foundation audit.
- Accounts payable analytics — the classic early win.
- How to audit the financial close — the CFO’s foundation audit.
- Pre-IPO SOX readiness — when deadlines dictate the first year.
- Internal audit in banking — mandated work in a bank’s first plan.
- Life of an audit finding — tracking the fixes that build credibility.
- Presenting to the audit committee — the plan presentation.
- Internal audit co-sourcing 101 — buying year-one skills.
- Internal audit KPIs — the first-year measures.
- The CFE and the fraud allegation protocol — agreeing the investigation protocol early.
- Standing Up Internal Audit After an IPO: The First 18 Months — the first 18 months: charter, plan, staffing, SOX and the committee.
Leave a Reply