A Strategy for Providing Assurance

UNTIL ITS REVISION IN 1999, THE IIA'S INTERnational Standards for the Professional Practice of Internal Auditing (Standards) suggested the maintenance of a catalog of possible audits - commonly called a strategic audit plan - from which auditors could develop an annual plan of internal audit activity.

However, this approach ignores the activity of other review functions, such as quality management (ISO 9000) teams or legal compliance/probity review functions, and generates cyclic review programs in which the bulk of an organization is reviewed over a three- to five-year period. Based on the concept of an "auditable unit," the plan implied that the whole operation of every such unit should be audited. However, because of the dynamic nature of most organizations, the old strategic audit plan was often neither strategic, nor much of a plan. Very often, by the time year three of the plan came around, the organization had changed beyond recognition - certainly the risk environment in which the organization operated was likely to be very different.