CAE Audit Plan Communication

• What does the performance standard 2020 "communication and approval" state?

  The chief audit executive must communicate the internal audit activity’s plans and resource requirements, including significant interim changes, to senior management and the board for review and approval. The chief audit executive must also communicate the impact of resource limitations.
• Prior to communicating the audit plan, the CAE must determine the resources needed to implement the plan, based on the risk-based priorities identified during the planning process.
• What do resources needed to implement the audit plan include?

  people, technology, funds.
• Typically a portion of the available resources is saved to address unplanned changes to the audit plan, which may include?

  • Unanticipated risks.
  • Requests for consulting engagements from senior management and/or the board.
• What are resource estimates based on?

  Resource estimates are typically based on experience or comparisons to a similar project. Once created, they can then be compared with available resources to identify potential gaps.
• Before formally presenting the annual audit plan to the board for approval, who does the CAE typically meet to solicit input?

  Individual senior executives
• What does the CAE do when soliciting input from senior executives before presenting the plan to the board for approval?

  • Address any concerns from the executives.
  • Incorporate their feedback as needed.
  • Obtain their support.
  • Gather more information about the timing of proposed engagements and the availability of resources.
• What does the CAE's presentation to the board include?

  • A list of proposed audit engagements.
  • A rationale for selecting each proposed engagement.
  • The objectives and scope of each proposed engagement.
  • A list of initiatives or projects that result from the internal audit strategy but may not be linked directly to an engagement.
  • Discussion of the proposed plan and the risk assessment on which it is based. This discussion will indicate the risks that will be addressed as well as those that cannot be addressed due to resource constraints.
• Once the audit plan is approved, what and who should the CAE communicate to?

  Once approved, the CAE should communicate the plan and resource requirements to senior management to give them sufficient time to include the plan requirements in the overall budget and so on.
• How can the conformance with standard 2020 "communication and approval" demonstrated?

  By keeping records of the distribution of the internal audit plan, a copy of the board meeting materials that includes the internal audit plan as presented, memos, emails, or notes that document internal discussions.