Risk Based Internal Audit Plan Example Appendix 1

Business area or Key risk description R1 Treatment Monitoring R2 Responsibility Date of last IA narrative IA Plan
activity and/or 2 line audit allocation
assurance

Governance Failure to comply with new 25 Re-design of Compliance team 20 Head of None to This is a new code of conduct 10 days
regulatory code of conduct on customer charter set up of testing Compliance date which becomes operation in
fair customer treatment and sales manual. checklist. and April. IA will liaise with
resulting in fines, complaints Complaints Compliance team and will review
Check-point controls Complaints KPIs
and loss of income. team checklist approach.
within sales process. and reporting
IA will verify accuracy of KPI
Sales team training.
complaints handling report.

Business A major IT outage that denies 25 Full scale ‘hot site’ Schedule of plan 15 Director of IT June 2012, In June this year there will be a 6 days
continuity access to front line systems business continuity testing. full test of back-up restoration
Review of
and use of central hardware. plan. with off- site PC set up. IA will
IT Team business
observe and validate IT team
IT back-up and Monitoring of continuity
report to senior man. Team
support. down time and prep
incidents. IA review of the downtime &
Emergency planning
incident log with trend analysis
training.
and examination of responses.

Purchasing Purchases of raw materials 25 Sample material Exception 12 Head of Sept 2011 2012 saw major over spend in 10 days
into the manufacturing cycle testing by product reporting upon Product review of the raw material purchasing
are unsuitable, too expensive design. price variations to Design tendering budget. IA will compare invoiced
and/or delivered too late. contracts by procedure. prices to contract prices using
Tendering plan as Purchasing
Finance. IDEA software and review any
per purchasing Manager
major variations. This will involve
strategy Review of
exception report production and
outstanding
Price increases management responses.
orders by Buying
above 5% reviewed
team.
and approved
purchasing manager

R1 Inherent risk score impact x likelihood on 5 by 5 matrix before risk treatment & monitoring

R2 Residual risk score impact and likelihood on 5 by 5 matrix after risk treatment & monitoring