# Build a risk-based annual internal audit plan

Scores the audit universe on risk factors and turns it into a prioritized annual plan that fits my team's capacity.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Analyze, Plan, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/build-a-risk-based-annual-internal-audit-plan

## Prompt

```text
Help me build a risk-based internal audit plan for the year.

**Audit universe:** [LIST of auditable entities - processes, business units, systems, locations]
**Strategic priorities and major changes this year:** [e.g. new ERP, acquisitions, new markets, restructuring]
**Enterprise risk register highlights:** [TOP RISKS or PASTE]
**Prior audit results and open issues:** [SUMMARY by area]
**Regulatory or mandatory coverage:** [e.g. SOX, required regulatory reviews, board requests]
**Coverage by other assurance providers:** [external audit, compliance testing, certifications]
**Team capacity:** [number of auditors x available hours, co-sourcing budget]

Do this:
1. Propose 5-7 risk factors (e.g. financial significance, regulatory exposure, change, complexity, control environment, time since last audit) with weights and a 1-5 scoring guide for each.
2. Draft a scoring table for my universe using only the information I provided; mark scores you cannot support as [NEEDS INPUT].
3. Rank entities and propose the plan: mandatory audits, high-risk audits, advisory reviews, follow-up work, and a contingency reserve (typically 10-20% of hours).
4. Estimate hours per engagement and check the total against capacity.
5. List what is deliberately not covered and the residual risk, so the audit committee can see the trade-offs.
6. Suggest a quarterly calendar that avoids year-end and other peak business periods.

Output: risk factor table, scored universe table, plan table (Engagement, Rationale, Type, Hours, Quarter), and a one-page summary for the audit committee.
```

## What to fill in

- e.g. new ERP, acquisitions, new markets, restructuring
- TOP RISKS or PASTE
- SUMMARY by area
- e.g. SOX, required regulatory reviews, board requests
- external audit, compliance testing, certifications
- number of auditors x available hours, co-sourcing budget
- NEEDS INPUT

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.