Annual risk-oriented audit planning is both mandatory and optional. In a changing world characterised by globalisation, climate change, geopolitical risks and advancing digitalisation, the primary task of internal auditing is to anticipate new risks and consistently align its own approaches and methods accordingly. The VUCA risks (volatility, uncertainty, complexity and ambiguity) lead to a challenging dynamic for the risk orientation of internal auditing, which is expressed in particular in risk-oriented audit planning.
The basic information and data for creating risk-oriented audit planning comes from past audits (98 per cent of the companies surveyed1), from the areas of risk management (89 per cent1) and compliance (85 per cent1) as well as from accounting and finance and business processes (> 65 per cent1). Individual influencing factors are also taken into account, such as IT and compliance issues, resource scarcity and external risks such as conflicts and embargoes. EHS (environment, health, safety) information is also included in the planning. The resulting risk-orientated audit planning can be adapted to changing circumstances over time.
