Chapter 3 – Policy Implications for Gaelic - University of Edinburgh

Internal Audit Planning Methodology
strategy that can be undertaken by Internal Audit. The IIA Position Statement on Risk
Based Internal Auditing (2003) states that “Internal Audit needs to adopt a risk based
approach compatible with that adopted by their organisation.”
Implication for the Internal Audit Plan of the University of Edinburgh
9. Our view of the University’s risk maturity is that the University can be classified as risk
defined as described in the IIA guidance (see Annex A). This was our assessment when
we first applied the IIA guidance in 2005-06 and we continue to hold this view following
subsequent re-assessments.
10. An organisation classified as being risk defined is not in a position to support a fully risk
based approach to Internal Auditing. Internal Audit is not able to provide its assurance
strategy solely based on the risk management processes, management of key risks and
reporting of risks; although it may be able to identify risk management policies or pockets
of risk management excellence and plan to provide assurance on these elements.
Additionally, Internal Audit should plan to provide assurance that control processes are
working according to the objectives or standards that have previously been set.
11. Therefore, the Internal Audit Plan consists of a blend of assignments drawn from the risk
management process and our ongoing cycle of location-based audits.
HEFCE – A Guide to Risk-Based Internal Audit in Higher Education (2004)
12. HEFCE commissioned guidance to assist institutions in applying the IIA Standards in a
higher education environment. It is not intended to be prescriptive but to outline a generic
application of a risk-based audit methodology. The term risk-based applies both to the
development and maintenance of the overall audit plan, and to the approach for individual
audit assignments.
13. The guidance provides a number of useful insights into developing the audit planning
process. Some relevant excerpts are listed below:
a. Audit Plans need to be dynamic to reflect the fast-changing nature of most
organisations. It is best to think in terms of planning no more than one year ahead.
Even with this short horizon, it will be necessary to review the plan to consider the
inclusion of emerging business issues and to drop audits that have reduced in
priority. Changing levels of priority may be driven by:
The HEI’s risk management process
The outcomes of other audits completed during the period
General discussions between the auditors, management and the audit committee.
Page 13 of 22