Audit Risk Model
Overall Audit Risk by Engagement
Composite audit risk score per engagement to drive resourcing.
Ranking engagements by risk to resource the audit plan
An internal audit function has finite hours, so the plan must steer them toward the engagements that carry the most risk to the organisation's objectives. A composite audit risk score per engagement lets the chief audit executive rank the plan and defend resourcing decisions to the audit committee. AuditPro Core produces an overall audit risk score for each engagement across the plan, turning resourcing from negotiation into evidence.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Planned engagements
22
High-risk engagements
7
Audit days allocated
1,840
Days to high-risk
62%
of capacity
Composite audit risk by engagement
Plan ranked by audit risk
| Engagement | Risk score | Audit days | Tier |
|---|---|---|---|
| SCM & tenders | 23 | 180 | High |
| Grant spending | 22 | 160 | High |
| Revenue & billing | 20 | 150 | High |
| ICT access | 18 | 120 | Medium |
| Fleet & assets | 14 | 90 | Medium |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Composite scoring
An engagement's overall risk blends factors such as inherent exposure, control maturity, prior findings and strategic significance. Combining them into one score makes very different engagements comparable for planning.
Risk-based planning
ISSAI and IIA standards expect the audit plan to be driven by a documented risk assessment. A defensible composite score is exactly what underpins that requirement.
Resource allocation
Higher-scored engagements warrant more hours, more senior staff or more frequent coverage. The score converts a ranking into a concrete allocation the committee can sign off.
Plan transparency
When every engagement carries a visible score, decisions to include, defer or drop work become explainable. This protects the function when scope is challenged after the fact.
How AuditPro Core Bridges the Gap
- Factor aggregation: engagement risk is computed from weighted factors so the score is transparent and repeatable.
- Plan ranking: engagements sort by composite risk to drive hour and seniority allocation.
- Traceability to source: each score links to the factors and ratings that produced it for challenge.
- Audit-ready export: the ranked plan exports as the documented risk basis the standards require.
Key Takeaways
- A composite score makes unlike engagements comparable for planning.
- Risk-based planning is a standards requirement, not a preference.
- Use the score to allocate hours and seniority, not just to rank.
- Visible scoring makes include/defer/drop decisions defensible.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.