Risk-based audit planning is a systematic methodology for designing an IT audit program by allocating finite audit resources proportionally to areas of highest organizational risk exposure. Rather than applying uniform coverage to all systems and processes, it uses the Audit Risk Model (Audit Risk = Inherent Risk × Control Risk × Detection Risk) to prioritize where auditors spend their time. The process begins with constructing an audit universe—a comprehensive inventory of all auditable entities—then applies risk assessment techniques to rank each entity by risk severity, and produces a documented audit plan that justifies every resource allocation decision with explicit risk-based reasoning. The output is a defensible, strategic audit plan, not a procedural checklist.
Where it stops · what it isn't
- —IS: the methodology for deciding which areas to audit, how much time to allocate, and why—before fieldwork begins
- —IS NOT: audit execution (fieldwork, testing, evidence collection), which follows the plan
- —IS NOT: a risk management function—auditors assess risk for planning purposes but do not own organizational risk mitigation
- —IS NOT: a one-time annual event—risk-based plans must be updated when significant changes occur (new systems, threat landscape shifts, control failures)
- —IS NOT: a guarantee of detecting all control weaknesses—detection risk can never reach zero; risk-based planning explicitly accepts residual detection risk in lower-priority areas
- —IS NOT: synonymous with compliance-driven audit planning, which applies standard audit programs regardless of risk profile
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFInformation Systems Auditing Process (CISA Domain 1)
REQUIRESAudit Universe DefinitionInherent Risk AssessmentControl Risk Evaluation
ENABLESAudit Scope Definition and Resource AllocationAudit Committee Reporting and Governance
RELATED TOAudit Project Management and Engagement PlanningContinuous Auditing and Monitoring (CAM)
CONSTRAINSAudit fieldwork—scope boundaries flow directly from risk-based plan decisions