At this stage, the internal audit department develops an annual audit plan, which is reviewed by the Chief Audit Executive and approved by Management Committee and Board Audit Committee (BAC). The audit plan consists of the strategy and methodology to be adopted by the internal audit department in executing the plan. The audit universe as well as the audit units are identified based on feedbacks from management and board audit committee on the strategic direction of the organization. The various areas and aspects of the organization to be audited is highlighted in the plan and scheduled based on resources available to the department.
For a given audit area scheduled in the plan, the audit programme is prepared by the audit Team Leader, which is approved by the Head of IS Audit Unit and the Chief Audit Executive. However, a caveat is included to state that the audit programme is subject to revision in accordance with changes in requirements, scope and schedule. In preparing the audit programme, the IT audit team engages the auditee management to understand their requirements and operating environment. Documents such as standard operating procedures, applicable internal policies, regulatory and statutory requirements, business pain points and Risk & Control Self-Assessment (RCSA) report of the audit client are requested prior to the commencement of the audit. The audit team reviews these documents to gain good understanding of the audit area, inherent risks, control issues and operational challenges confronting the auditee. Based on the pre-audit assessment, the Audit Team Leader defines the scope of the audit from risk perspective and according to the resources and time available to it. The audit team are also at liberty to obtain, prepare and analyze data needed to confirm the effectiveness and adequacy of controls. It is recommended that data preparation and analysis are carried as pre-audit activity and done offsite to enable the audit team gain speed and traction when the fieldwork commences so as not to struggle with limited resources and time-frame for execution.
From this audit programme, the Team Leader will prepare the respective audit plans, which is communicated to the other team members and audit client. At this point, the audit engagement notice/letter can be issued articulating the objectives, scope and requirements for the audit. The plan may include the following among others.
Audit objective and scope.
Department/Section and responsible individuals in charge.
Audit team members. The number of auditors depends on the size of the audit area and complexity of the departmental functions to be audited.
Date, place and time of the audit.
Opening meeting, where deemed appropriate by the auditee management and Team Leader, shall be held on the day of commencement of audit. The following may be discussed during the opening meeting:
The purpose and scope of the audit.
Confirmation of the audit plan.
Clarification of other matters such as requirements, audit approach, documentation, rating/scoring method and consequence management should be agreed before the audit kicks off.