Implementing an internal audit plan aligned with the Global Internal Audit Standards

An internal audit plan is a risk-based programme connecting institutional priorities to assurance engagements, resources and approved changes.

For South African institutions, implementation begins with the applicable mandate, documented risks and a realistic view of capacity. The chief audit executive translates that evidence into proposed coverage and explains limitations to the responsible governing body.

Distinguishing the 2024 Global Internal Audit Standards from legacy Treasury guidance

The operation of internal control systems is the responsibility of the relevant line managers.

— National Treasury Internal Audit Framework2009, section1.3.2.5, page8

Governing bodies and audit executives must distinguish between the Global Internal Audit Standards issued by the Institute of Internal Auditors in January 2024, effective January 2025, and historical public sector guidelines. Domain IV of the 2024 Standards establishes mandatory requirements for managing the internal audit function, framing plan development under Principle 9 and Standard 9.4.

In contrast, the National Treasury Internal Audit Framework Revised 2009 provides dated contextual guidance for South African public entities. While Treasury 2009 outlines practical steps for developing strategic and operational plans, it relies on earlier professional frameworks and does not reflect current global requirements.

Organisations must recognise that Treasury 2009 serves as a useful national benchmark rather than the definitive standard for internal audit practice. Adopting the 2024 Standards requires adhering to strict terms: "must" denotes unconditional requirements, "should" specifies preferred practices, and "may" indicates optional implementation choices. This article provides advisory implementation guidance without asserting certified conformance.

Understanding this framework distinction ensures that audit leaders apply current global expectations while respecting historical local guidance. The 2024 Standards establish an integrated structure across five domains, emphasising strategic alignment, professional objectivity, and robust governance oversight.

Internal audit methodologies must be maintained in alignment with the Standards and reviewed periodically to reflect operational shifts. This structural clarity reinforces functional independence and assurance reliability across public and private sectors.

Conducting the organisation-wide risk assessment and establishing audit priorities

Implementing an internal audit plan begins with an organisation-wide risk assessment performed at least annually. Standard 9.4 mandates that the chief audit executive base the plan on a documented evaluation of strategies, objectives, and risks, informed by direct input from the board and senior management. This ensures alignment across strategic, operational, and financial dimensions.

To structure this assessment, audit teams establish an audit universe comprising auditable business units, processes, and systems. The internal audit function independently validates management's risk data, relying on management assessments only when risk processes are evaluated as effective. Treasury 2009 similarly emphasises a top-down operational review to identify exposures that threaten strategic goals.

The implementation considerations encourage a risk assessment that considers threats and opportunities affecting institutional objectives. Internal auditors gather risk information from previous audit engagements, executive interviews, board discussions, and regulatory communications.

To translate risk findings into audit priorities, internal audit teams evaluate risk severity against control effectiveness across key operational areas:

• Coverage of information technology governance frameworks and system risks.
• Evaluation of fraud risks and the implementation of fraud prevention plans.
• Assessment of compliance with relevant laws, regulations, and statutory mandates.
• Review of operational efficiency, resource stewardship, and program effectiveness.
• Examination of ethics programs and organisational culture indicators.

Proper risk prioritisation prevents audit resource misallocation by focusing assurance effort where risk exposure is greatest. High-risk operational areas require concentrated risk-based audits of key controls, whereas lower-risk areas receive cyclical maintenance coverage.

Formulating the flexible internal audit plan and determining resource requirements

Following the risk assessment, the chief audit executive formulates a dynamic internal audit plan that specifies assurance and advisory services. Standard 9.4 requires the plan to be flexible, adjusting promptly to shifts in business operations, emerging risks, and organisational culture. Treasury's 2009 framework similarly recommends that operational plans reflect current organisational strategies.

A useful plan sets out proposed engagements, their general purpose, preliminary scope and selection rationale. The implementation considerations accompanying Standard 9.4 suggest reserving capacity for contingencies and ad hoc requests; they do not prescribe a universal percentage.

Plan formulation requires determining the necessary human, financial, and technological resources. Under Standards 8.2 and 10.2, the chief audit executive evaluates staff numbers, technical competencies, and productive work hours. Conducting a formal gap analysis between available capacity and planned audit coverage highlights resource shortfalls that require executive attention.

Resourcing options include in-house staff, co-sourcing with specialised external providers, or full outsourcing. Under Standards 10.1 and 10.3, the chief audit executive must secure budget approval for operations, training, and technology tools, ensuring effective deployment without compromising functional independence. Treasury 2009 notes that oversight of the internal audit function cannot be outsourced even when co-sourced providers are engaged.

Resource planning also entails evaluating technological requirements to support audit workflows, data analytics, and continuous monitoring. Collaborating with information technology functions ensures proper implementation of technology tools while maintaining data security.

Effective human resource management includes developing training programmes to maintain staff skills and alignment with updated audit methodologies.

Securing board approval and implementing change control protocols

Once formulated, the internal audit plan and associated budget must be submitted to the board for review and formal approval. Standard 9.4 mandates that the chief audit executive communicate the impact of resource limitations, the rationale for omitting high-risk areas, and conflicting stakeholder demands. Treasury 2009 requires similar submission to the audit committee and accounting officer.

Board presentation should include the list of next-priority engagements that would be performed if additional resources were available. This transparent disclosure assists governing bodies in evaluating whether the internal audit function possesses sufficient capacity to fulfil its mandate.

Change control is vital for maintaining plan flexibility while preserving governance discipline. The implementation considerations accompanying Standard 9.4 recommend agreeing criteria and protocols for significant interim plan revisions. Significant changes include postponing or cancelling engagements related to critical risks or mission-critical objectives.

When emerging risks necessitate immediate adjustments before a scheduled board meeting, the chief audit executive should inform the board promptly and arrange formal approval as soon as possible, as described in the implementation considerations. Material changes to the operational plan must always receive board approval to protect assurance integrity.

Establishing a formal protocol for managing interim changes prevents unvetted scope reductions and maintains mutual alignment between management, the board, and internal audit leadership.

Evidence matrix for internal audit plan implementation

Reviewing implementation requires clear documentation across the planning cycle; the matrix is not a complete conformance assessment. The four-column matrix below distinguishes requirements from recommended practices and supporting evidence across the plan implementation lifecycle.

For wider context, read the internal audit delivery models overview.