The annual internal audit plan is approved once and defended for the rest of the year. It is a comfortable habit, and it fits less and less with what the profession's standards and the audit committee ask for.

Standard 9.4 of the Global Internal Audit Standards, effective since January 2025, requires the plan to be based on a documented risk assessment performed at least annually. The same text requires the plan to be dynamic and updated timely in response to changes in the organisation's business, risks, operations, programmes, systems, controls and culture.

The considerations for implementation go further. The chief audit executive should keep continuously apprised of risk information and update the risk assessment and the plan accordingly. In a dynamic environment, the plan may need to be updated every six months, quarterly or even monthly.

In Spain, public interest entities have one more reference. The CNMV Technical Guide 1/2024 on audit committees, issued in June 2024 by the Spanish securities regulator, recommends that when monitoring the plan the committee checks, among other things, whether the main business risk areas identified in the plan are adequately covered in practice. It also asks the committee to check whether significant changes are reported to it and whether any update to the plan is approved through the same procedure as the original.

A plan that does not change in twelve months is not a stable plan. It is a plan nobody has looked at again.

What should move the plan

Standard 9.4 does not set a frequency, it sets a criterion. It recommends that the chief audit executive, the board and senior management agree on the significant changes that require a revision of the plan, and that the agreement is built into the function's methodology. These are reasonable triggers to write into it.

  1. A change in the organisation. An acquisition, the sale of a business or a reorganisation.
  2. A system that changes. An ERP migration, the replacement of a critical supplier or an AI deployment in a process that touches customers or money.
  3. An incident or a serious finding. A breach, a fraud or a key control failing in another engagement changes the risk of neighbouring areas.
  4. A new obligation. A regulation or a requirement that forces a look at an area the plan did not include.
  5. A resource that does not arrive. A specialist leaving or a budget cut. Standard 9.4 requires the impact of any resource limitation on coverage to be communicated to the board and senior management.

How a moving plan is governed

Moving the plan without control is as bad as never moving it. Three practices keep it in order.

  • A review with a date. A quarterly checkpoint with the updated risk assessment, even when it concludes nothing needs to change.
  • Reserved hours. The standard itself suggests that the proposed plan includes a percentage of hours reserved for contingencies and ad hoc requests. Without that margin, every new engagement displaces another one without anyone deciding it.
  • A record of what drops out. If an engagement is cancelled or postponed, the reason and the approval are recorded. The standard gives cancelling or postponing engagements related to significant risks as an example of a significant change, and the CNMV guide asks the annual activity report to explain planned engagements that were not carried out and those carried out without being planned.

Reviewing every quarter does not mean rebuilding the plan every quarter. It means that every three months someone compares the current risk assessment with the split of hours and records whether they still match. When they do not, the change arrives with its reason and its approval.

The underlying question is the one raised when we saw that audit effort does not follow the risk. A plan well chosen in December can be out of date by March, and the difference lies in how often it is looked at again.