Audit Scope Should Follow Risk, Not Last Year’s Program

A familiar audit program is useful only while it answers the right risk question. Repeating procedures can create an appearance of coverage while important changes remain outside the work.

Identify what has changed

Consider an illustrative retailer that introduced a supplier self-service portal. Last year's purchasing audit concentrated on purchase orders, receipts and invoice approvals. This year, supplier bank details can also be changed through the portal.

The old tests may still be useful. But the current question also includes who can request a change, how it is verified, what reaches the payment system and how an unexpected change is investigated. Reusing an invoice checklist alone would leave that route largely unexplored.

Make a concise change map: business model, transaction channels, systems, people, incentives and third parties. Use interviews and process walkthroughs to identify the questions that need evidence. A change is a signal to assess, not an automatic conclusion that the process is failing.

Refresh the risk assessment

The IIA Global Internal Audit Standards became effective on January 9, 2025. Standard 9.4 addresses a dynamic internal audit plan informed by a documented assessment of organizational objectives and risks. At engagement level, Standard 13.2 links understanding the activity to identifying and prioritizing relevant risks; a previous assessment can be reviewed and updated.

For our illustration, separate the exposure from its possible explanation. An unauthorized bank-detail change is an exposure. Weak identity checks, inappropriate access or an incomplete interface may be possible causes to investigate. Do not write a finding before obtaining support.

Define the assurance question

Write the intended conclusion before choosing detailed tests. For the new portal, a focused objective could be to evaluate whether supplier bank-detail changes are authorized, supported and accurately transferred to the payment process.

Then identify the information needed to reach that conclusion. A list of current supplier details alone will not explain which details changed or whether the relevant verification occurred. The historical population and associated approvals may be more useful.

Set boundaries that fit the question

Standard 13.3 addresses documented engagement objectives and scope, including the boundaries needed to achieve the objective. Changes require CAE approval. Under Standard 13.6, the work program follows planning information and requires CAE review and approval. The official Standards text distinguishes these responsibilities from approval of the organization-level audit plan.

In the illustration, define the portal, supplier master, interface and payment process included in the work. Specify the period and relevant transactions. Explain exclusions so readers know what the conclusion covers. A scope called simply “purchasing” can hide important gaps.

Adapt the procedures

Possible work could include examining permissions, tracing selected change requests through verification and checking how approved details reach payment records. The exact approach depends on the risk, available evidence and engagement objective.

Retain prior tests where their purpose remains relevant. Update, replace or add work where the process has changed. Record why the choice supports the question. Increasing sample size in the old invoice population does not automatically address the new bank-change route.

Keep changes and limits visible

Suppose a walkthrough reveals that some portal changes are uploaded in a separate batch. Investigate whether that affects the intended coverage and discuss the implications before treating the original scope as sufficient.

If relevant data cannot be obtained, record what is missing and how that limits the conclusion. The Standards require scope limitations to be discussed with management and unresolved issues escalated through the CAE under the established methodology.

This illustrative approach is not a complete audit methodology. Mandatory coverage, applicable Topical Requirements, resources and the organization's mandate also shape the work.

Prior work provides memory. Current risk provides direction.