Determining the Audit Universe (Risk-Based Audit)

An audit universe represents a range of potential audit activities to be carried out by internal audit function. It consists of several auditable entities, processes, systems and activities. Maintaining an audit universe is not a mandatory requirement in professional audit practice. However, it has been proven to be a good practice. For organization that have a good risk management practices, a robust risk assessment outcome helps the Chief Audit Executive (CAE) decide how to organize the audit universe such that areas of significant/high risk are subject to more audits than areas of low risk. This is also known as risk-based auditing. Because of limited resources, the internal audit function may not be able to embark on all possible audit activities or engagements but does so based on risk prioritization. As such, the audit universe is determined and updated based on critically of the risk areas that could be subject to audit. This will then determine the list of possible audit engagements that could be performed during the fiscal period to address the identified risk areas. Projects, activities, initiatives, business units, processes or controls relating to the organization’s strategic objectives could be included as part of the audit universe.


It is important to note that board/senior management or regulatory requested reviews that may not be part of the audit universe could take precedence over audit activities or engagements scoped in the audit universe. Hence, it is the duty of the CAE to continually update the audit universe to reflect all risk inherent in the operating environment as well as the needs of key stakeholders.

To get our IT audit programs/checklists, Click here

To get our risk assessment templates, Click here



Back To Internal Audit Leading Practices

Let us know your thoughts post. Leave a Comment below.