Treasury Internal Audit Framework Revised ... - National Treasury

Establishment of IAA
changing priorities and emerging audit needs.
The AC should approve material changes to
the operational IA plan.
3.5.1 Risk Based Planning
Risk based planning means finding the correct
balance of risk based versus cyclical based
audits. This balance depends on the maturity
of an organisation’s systems and processes,
the extent to which policies and procedures
and internal controls are entrenched and
complied with, and the general strength of the
wider control environment. Best practice is
that the IAA spends most of its time on riskbased
audits, and the rest on cyclical based
audits, follow-up audits and ad hoc requests.
3.5.1.1 Risk based audits
Given the results from the risk assessments
performed (which generally indicate only a
satisfactory-to-weak control environment) it
may be appropriate for the IAA to focus its
attention on the high risk areas, mostly
concentrating on ensuring that key controls
are in place and adhered to.
37 Internal Audit Framework