Annual risk-oriented audit planning is both mandatory and optional. In a changing world characterised by globalisation, climate change, geopolitical risks and advancing digitalisation, the primary task of internal auditing is to anticipate new risks and consistently align its own approaches and methods accordingly. The VUCA risks (volatility, uncertainty, complexity and ambiguity) lead to a challenging dynamic for the risk orientation of internal auditing, which is expressed in particular in risk-oriented audit planning.
Risk-oriented audit planning should be determined on the basis of the organisation's risk profile ("organisational risk profile", GIAS Standard 9.1). Audit planning is based, among other things, on data from past audits, risk management, compliance, accounting and business processes. Individual factors and EHS information (environment, health, safety) are also included in the planning. In addition, compliance with the topical requirements[1] in the relevant audit areas must be taken into account. Around 40 per cent of the participants in a survey[2] that we conducted stated that the topical requirements have already been largely or fully taken into account in the current audit planning.
