Audit Universe & Planning
Risk-ranked auditable units driving the annual plan.
A risk-ranked inventory of every auditable unit, process and system — the basis for the rolling three-year strategic audit plan and the annual plan approved by the Audit Committee.
What you get
- Risk ranking
- Plan allocation
- Coverage gaps
Why it matters
A risk-ranked map that points the plan at real risk.
The audit universe is the map that makes risk-based auditing possible. It is the risk-ranked inventory of every auditable unit, process and system in the entity — and it is the foundation on which the IIA requires the annual and three-year strategic audit plans to be built. Without a universe, audit coverage is driven by habit and availability rather than risk, and the function cannot demonstrate to the Audit Committee that it is auditing the things that matter most.
When the universe is missing or stale, the consequences are structural: high-risk processes go unaudited for years, the plan cannot be defended to the committee or the external quality assessor, and combined-assurance gaps stay invisible. AGSA and the EQA both probe whether the plan flows from a documented, risk-ranked universe — and a spreadsheet that was last scored two years ago does not answer that.
A living universe scores each unit on impact, likelihood and control adequacy, sets the audit-cycle frequency accordingly, and allocates units to years and engagements by risk and capacity. Coverage gaps surfaced by combined assurance feed straight back in, so the plan is always pointed at the real risk.
Capabilities
What Audit Universe & Planning does.
Risk ranking
Each unit scored on impact × likelihood × control adequacy.
Plan allocation
Units allocated to years and engagements by risk and capacity.
Coverage gaps
Combined-assurance gaps feed back into the universe.
Outcomes
What changes for your team.
Tangible improvements an entity sees once Audit Universe & Planning replaces the spreadsheet.
How it works
From data to defensible signal.
Want to see Audit Universe & Planningrunning on your entity's own data?
Enquire nowWho it's for
- Chief Audit Executive and Internal Audit Managers
- Audit Committee approving the plan
- Quality-Assurance reviewer for the IIA External Quality Assessment
Legislative basis
- IIA Standard 2010 — risk-based planning
- IIA Standard 2030 — resource management
- IIA Standard 2050 — coordination and reliance
- Treasury Regulation 3.2.5 — internal-audit coverage and planning
FAQ
Questions teams ask before they sign up.
How does this strengthen our annual audit plan?
The plan is built directly from the risk-ranked universe, so every engagement traces to a documented impact-likelihood-control score. That is exactly what the Audit Committee and the IIA external quality assessment expect to see.
Does it connect to combined assurance?
Yes. Coverage gaps identified by the combined-assurance heat-map feed back into the universe, so under-assured risks are prioritised in the next plan.
How often should the universe be refreshed?
It is reviewed annually with the Audit Committee, with risk scores updated so the plan always reflects the current risk profile rather than last year's.
Want to know more about Audit Universe & Planning?
Tell us about your entity and we'll be in touch with a walkthrough, pricing and next steps — everything you see is traceable to source.