Noora Al-Marri makes a good argument that you need one in an article in the IIA’s magazine: Building a Better Auditor: Why Internal Audit Needs a Strategic Plan.
Noora says:
I believed that the risk-based plan should be the roadmap to guide internal audit functions throughout the year. After all, this plan is built taking into consideration the company’s strategies and strategic risks, among other things. As it turns out, I was wrong!
I wondered about the reason for requiring a strategic plan and whether internal audit could continue to function without having such a plan. Internal audit can indeed continue without having a strategic plan, but soon the truth will hit hard — the internal audit function will have lost its relevance to the organization.
Why might internal audit become irrelevant to the organization? Consider the risk of reviewing processes or areas the same way, over and over again, irrespective of how these processes or areas are evolving. How can I deliver on the internal audit mission “to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight” when the things around me evolve — but I don’t?
Noora is wrong! Sorry.
A risk-based audit plan is agile and flexes with changes in the organization, its objectives, the related risks,…
