Build a risk-based annual internal audit plan
Scores the audit universe on risk factors and turns it into a prioritized annual plan that fits my team's capacity.
The prompt
Help me build a risk-based internal audit plan for the year.
Audit universe: [LIST of auditable entities - processes, business units, systems, locations]
Strategic priorities and major changes this year: [e.g. new ERP, acquisitions, new markets, restructuring]
Enterprise risk register highlights: [TOP RISKS or PASTE]
Prior audit results and open issues: [SUMMARY by area]
Regulatory or mandatory coverage: [e.g. SOX, required regulatory reviews, board requests]
Coverage by other assurance providers: [external audit, compliance testing, certifications]
Team capacity: [number of auditors x available hours, co-sourcing budget]
Do this:
1. Propose 5-7 risk factors (e.g. financial significance, regulatory exposure, change, complexity, control environment, time since last audit) with weights and a 1-5 scoring guide for each.
2. Draft a scoring table for my universe using only the information I provided; mark scores you cannot support as [NEEDS INPUT].
3. Rank entities and propose the plan: mandatory audits, high-risk audits, advisory reviews, follow-up work, and a contingency reserve (typically 10-20% of hours).
4. Estimate hours per engagement and check the total against capacity.
5. List what is deliberately not covered and the residual risk, so the audit committee can see the trade-offs.
6. Suggest a quarterly calendar that avoids year-end and other peak business periods.
Output: risk factor table, scored universe table, plan table (Engagement, Rationale, Type, Hours, Quarter), and a one-page summary for the audit committee.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- e.g. new ERP, acquisitions, new markets, restructuring
- TOP RISKS or PASTE
- SUMMARY by area
- e.g. SOX, required regulatory reviews, board requests
- external audit, compliance testing, certifications
- number of auditors x available hours, co-sourcing budget
- NEEDS INPUT
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Check auditor independence before accepting a new attest clientA structured independence and threats-and-safeguards review for a CPA firm before taking on an audit, review, or other attest engagement.
- Validate that an audit issue is really fixed before closing itSets out the evidence and tests needed to confirm remediation is effective and sustained, so issues are not closed on paper only.
- Assess the impact of a regulatory changeWhat a new rule requires, who it affects, and what must change.