Where do you even start when auditing a massive IT system? The answer is not 'check everything' – that would take years and bankrupt the company. Audit planning solves this by forcing you to focus on what matters most: the risks that could genuinely stop the business from achieving its objectives. For the CISA exam, understanding how to plan an audit based on risk assessment is the single most practical skill you will learn, because every real-world audit starts here.
Jump to a section
A simple way to picture Audit Planning and Risk Assessment
You are about to buy your first house. The estate agent says it's perfect, but your gut says 'get a surveyor'. What does a good surveyor actually do? Do they just walk through every room and list every crack in the plaster? That would take days and cost a fortune. Instead, a savvy surveyor does something smarter: she plans her inspection based on risk.
First, she looks at the big picture. The house is 100 years old, has a damp basement, and the roof was patched hastily last year. Those are high-risk areas. The kitchen cabinets are from the 90s and ugly, but they are structurally fine – low risk. So she allocates her limited time: two hours probing the damp-proofing in the basement, one hour on the roof structure, and just a quick glance at the cupboards. She doesn't inspect every single window lock; she prioritises. That is risk-based planning.
Then she aligns her inspection with the buyer's objective. The buyer's business goal is 'live here safely for ten years without a catastrophic repair bill.' So the surveyor's plan focuses on long-term structural integrity, not cosmetic issues. If the objective were 'flip the house in six months,' the plan would change completely – she'd focus on kitchen and bathroom finishes. This is exactly how an IS auditor plans an audit: you identify the business goals, assess the risks to those goals, and then create an audit plan that targets the highest-impact risks first.
Audit planning is the process of deciding what to look at, how deeply to look, and what resources to use to check if an organisation's IT systems are secure, reliable, and efficient. It is not a random checklist. It is a structured approach driven by two core concepts: risk assessment and business objectives.
Let's define the key terms.
An 'IS audit' (Information Systems audit) is a formal examination of an organisation's technology systems, processes, and controls. Its goal is to provide an independent opinion on whether those systems are protecting assets, maintaining data integrity, and supporting the organisation's goals.
'Risk assessment' is the process of identifying, analysing, and evaluating potential problems that could harm the organisation. In IT, these problems include data breaches, system outages, regulatory fines, and fraud. A risk assessment asks two simple questions: 'What could go wrong?' and 'How bad would it be?'
'Business objectives' are the specific goals the organisation is trying to achieve. For example, 'process 10,000 customer orders per day with 99.9% uptime' or 'ensure patient records are accessible within 5 seconds.' The audit must align with these objectives – an audit that ignores the company's priorities is useless.
Here is how the process works step by step.
First, the auditor gathers information about the organisation. This includes meeting with senior management to understand the business strategy, reviewing financial reports, and reading IT policies. The auditor needs to know what the company is trying to do and how it uses IT to do it.
Second, the auditor performs a risk assessment specifically focused on the IT environment. This is often guided by a formal framework like COBIT (Control Objectives for Information and Related Technologies) or ISO 27001. The auditor identifies threats (like hackers or hardware failure), vulnerabilities (like unpatched software or weak passwords), and the potential impact (like lost revenue or legal penalties). Risks are then ranked by likelihood and impact – high, medium, or low.
Third, the auditor develops an audit plan. This plan documents which areas will be reviewed, the scope of the audit, the resources needed (staff, time, tools), and the timeline. The plan is directly linked to the risk assessment: high-risk areas get more attention, low-risk areas get less.
For example, a bank's main business objective might be 'process credit card transactions securely.' A risk assessment would identify 'payment card data theft' as a high-risk threat. The audit plan would then focus heavily on the systems that store, process, or transmit credit card data, along with the controls protecting that data, such as encryption and access restrictions. It would spend very little time on, say, the company's internal employee training portal, because that portal presents a much lower risk to the core business objective.
Why does this matter? Before risk-based audit planning became standard, auditors often used a 'checklist approach.' They would inspect the same things every year, regardless of whether the organisation's risks had changed. This was inefficient and often missed major emerging risks. Risk-based planning replaced that rigid approach with a dynamic, flexible one. It ensures that every audit hour is spent where it can add the most value – reducing the most critical risks to the business's most important goals.
Understanding this concept is essential for the CISA exam. You will be tested on how to apply risk assessment to prioritise audit activities, how to align an audit plan with business objectives, and how to justify your audit scope decisions to stakeholders. The exam expects you to think like an auditor, not a technician.
Understand Business Objectives
The auditor meets with key stakeholders (CEO, CFO, IT director) to identify the organisation's strategic goals. For a hospital, this might be 'maintain 100% uptime for patient records.' This step ensures the audit addresses what actually matters to the business.
Perform a Preliminary Risk Assessment
The auditor identifies potential threats and vulnerabilities related to the IT systems that support the business objectives. This involves reviewing past incidents, interviewing staff, and using frameworks like COBIT. The goal is to rank risks by likelihood and impact.
Define Audit Scope and Objectives
Based on the risk assessment, the auditor decides which systems, processes, and locations to include in the audit. The scope must be specific enough to be actionable but broad enough to cover key risks. For example, 'review the payment processing system and its disaster recovery plan.'
Allocate Resources and Develop a Timeline
The auditor determines how many staff are needed, their skills (e.g., a security specialist for encryption reviews), and the budget. A timeline is created with milestones. This step ensures the audit is feasible within the organisation's constraints.
Document and Approve the Audit Plan
The auditor writes a formal audit plan that includes scope, objectives, risk summary, resource allocation, and timeline. This plan is presented to the audit committee or management for approval. Approval gives the auditor authority to proceed.
Execute the Audit and Adjust as Needed
The auditor carries out the planned procedures (interviews, tests, document reviews). If new risks are discovered, the plan may be adjusted – but changes must be documented and approved. This step is where the actual evidence gathering happens.
Meet Priya, a newly certified IS auditor working for a mid-size e-commerce company called 'ShopWave.' The company sells clothing online and processes about 50,000 orders per month using a cloud-based platform.
The Chief Information Officer (CIO) asks Priya to plan the annual IS audit. She does not just open a template and start checking boxes. Instead, she follows a risk-based planning process.
First, Priya meets with the Chief Financial Officer (CFO) and the Head of Sales. She asks about ShopWave's top business objectives for the next year. They tell her:
Increase online sales by 20%.
Launch a new mobile app by Q3.
Ensure 99.9% uptime during the holiday shopping season.
Comply with new data privacy regulations (GDPR) in Europe.
Next, Priya performs a high-level risk assessment of the IT systems that support these objectives. She reviews incident reports from the past year, talks to the IT operations team, and uses the COBIT framework to identify potential threats. She finds:
The payment processing system was down for 2 hours last December during a sale – high risk.
The mobile app development is behind schedule – medium risk, because it could delay the launch.
Customer data is stored on a shared server without full encryption – high risk, because a breach would violate GDPR and result in huge fines.
The employee email system is outdated but not directly connected to sales or customer data – low risk.
Priya then drafts an audit plan that allocates resources based on these findings. The plan includes:
A deep review of the payment processing system, including its uptime monitoring, backup procedures, and security controls.
A review of the mobile app development lifecycle, focusing on security testing before release.
A thorough audit of data storage and encryption practices, specifically addressing GDPR compliance.
Only a cursory check of the email system – maybe a quick review of spam filters and password policies.
Priya also estimates the time and budget required. The payment system audit will take 3 weeks with two senior auditors. The data privacy review will take 2 weeks with a specialist. The email review will take 2 days. She documents all this in the audit plan and presents it to the audit committee for approval.
During the audit, Priya finds that the payment processing system lacks a proper disaster recovery plan – a critical finding. She reports this to management, who prioritise fixing it before the holiday season. The audit added real value because it was focused on the risks that mattered most to ShopWave's business objectives.
The CISA exam tests 'Audit Planning and Risk Assessment' heavily. Expect to see 5-10 questions on this topic in the exam. The questions are designed to test your ability to apply concepts, not just memorise definitions.
Here are the specific topics and patterns you must master:
Linking audit scope to business objectives. The exam loves to give you a scenario with several business objectives and ask which area the audit should focus on first. The correct answer is always the one that aligns with the organisation's stated goals.
Risk-based audit planning. You will be asked to rank audit areas by priority based on risk level (high, medium, low). Remember: high likelihood + high impact = top priority.
The difference between inherent risk and residual risk. 'Inherent risk' is the risk before any controls are applied. 'Residual risk' is the risk that remains after controls are in place. Auditors focus on residual risk when planning.
Types of audits. Know the difference between a financial audit (focuses on money), an operational audit (focuses on efficiency), an integrated audit (combines financial and controls), and a compliance audit (focuses on regulations).
The role of the audit charter. The audit charter is a formal document that authorises the audit function, defines its scope, and establishes its independence. It is not the same as the audit plan – it is the higher-level mandate.
Materiality. A concept from financial auditing adapted to IT. 'Materiality' is the threshold below which a weakness is not considered significant enough to report. The exam tests that materiality is defined based on the impact on business objectives.
Common traps in exam questions:
They present a detailed list of technical risks (e.g., firewall misconfiguration, weak encryption) and ask for the audit plan. The trap is to start auditing technical details immediately. The right answer is always to first confirm the business objectives and risk assessment.
They ask about 'scope creep.' Scope creep happens when the audit expands beyond the original plan. The correct answer is that scope creep should be formally reviewed and approved by management, not just ignored.
They describe a situation where a company has no risk assessment documentation. The trap is to skip the risk assessment and jump into auditing. The right answer is to perform a preliminary risk assessment as part of the planning phase.
Key definitions to memorise:
Audit risk = the risk that the auditor will issue an incorrect opinion.
Control risk = the risk that internal controls will fail to prevent or detect errors.
Detection risk = the risk that audit procedures will not catch errors.
Business impact analysis (BIA) – assesses the effect of disruptions on business operations.
Practise by writing out the steps of audit planning from memory. The exam expects you to sequence them correctly: understand business objectives, perform risk assessment, develop audit plan, allocate resources, execute audit, report findings.
Audit planning must always begin with understanding the organisation's business objectives, not with a technical checklist.
Risk assessment determines which areas of IT to audit and how deeply; high-risk areas get more attention than low-risk ones.
The audit plan documents scope, resources, timeline, and is formally approved by management or the audit committee.
Inherent risk is the risk before controls; residual risk is the risk after controls – auditors focus on residual risk.
Materiality is the threshold that determines whether a weakness is significant enough to report to management.
Scope creep must be formally managed and approved; expanding an audit without authorisation weakens the audit's credibility.
The audit charter authorises the audit function; the audit plan directs a specific engagement.
Audit risk is the combination of control risk, detection risk, and inherent risk – the auditor aims to keep it acceptably low.
These come up on the exam all the time. Here's how to tell them apart.
Audit Plan
High-level document outlining scope, objectives, resources, and timeline
Created early in the audit process, before detailed procedures
Approved by management or audit committee
Audit Programme
Detailed set of step-by-step procedures and tests to perform
Derived from the audit plan, created after the plan is approved
Used by auditors during fieldwork to gather evidence
Inherent Risk
Risk that exists before any internal controls are applied
Determined by the nature of the business activity itself
Higher in areas like online payment processing than in internal email
Residual Risk
Risk that remains after controls are implemented
What the organisation actually faces on a day-to-day basis
Auditors evaluate residual risk to determine if further action is needed
Audit Risk
Risk that the auditor issues an incorrect opinion
Controlled by the auditor through proper planning and testing
Three components: control risk, detection risk, inherent risk
Business Risk
Risk that an event could harm the organisation's objectives
Managed by the organisation, not the auditor
Includes threats like data breaches, system outages, regulatory fines
Scope Creep
Unauthorised expansion of audit scope beyond the plan
Weakened audit integrity and resource allocation
Should be avoided and controlled by strict change management
Scope Change (Approved)
Formally documented and approved modification to audit scope
Reflects new risks or business needs discovered during the audit
Keeps the audit aligned with objectives and maintains credibility
Mistake
Audit planning is just filling out a template or checklist each year.
Correct
Audit planning is a dynamic, risk-based process that must be tailored to the current business objectives and risk environment. Using the same template every year misses new risks.
Many beginners come from backgrounds where audits are seen as repetitive compliance exercises, like tax filing. They do not realise that IT risks change constantly (new threats, new systems) and planning must adapt.
Mistake
The auditor should audit everything in the IT environment equally to be thorough.
Correct
It is impossible and inefficient to audit everything. The auditor must prioritise based on risk and business impact. A risk-based approach is more effective and is the standard expected by CISA.
Beginners fear missing something and believe that 'equal coverage' equals 'thoroughness.' They do not understand that auditing low-risk areas wastes time that should be spent on high-risk ones.
Mistake
Risk assessment is only done once at the beginning of the audit and never revisited.
Correct
Risk assessment is an ongoing process. During the audit, new risks may emerge (e.g., finding a major vulnerability), and the plan should be adjusted accordingly.
People often think of planning as a one-time event, like creating a project plan. They do not realise that auditing is iterative and that findings can change the risk profile.
Mistake
The audit plan is the same as the audit charter.
Correct
The audit charter is a high-level document that establishes the authority and scope of the internal audit function. The audit plan is a specific, time-bound plan for a particular audit engagement. They are different documents.
The terms sound similar, and beginners often use them interchangeably. The exam explicitly tests this distinction.
Mistake
Business objectives are irrelevant to an IT audit; the auditor only cares about technical controls.
Correct
Business objectives are the foundation of audit planning. An IT audit that ignores what the business is trying to achieve may focus on the wrong things and provide no value to management.
Technical people sometimes view IT as separate from business. They forget that IT exists to serve the business, and the audit must evaluate whether IT supports those business goals.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An audit plan is the high-level document that outlines scope, objectives, resources, and timeline for a specific audit. An audit programme is a more detailed set of procedures and steps that auditors will follow to gather evidence. The plan comes first; the programme is derived from it.
You do not need to memorise every COBIT process, but you must understand that COBIT is a framework used for governance and management of enterprise IT. The exam might ask about its purpose (aligning IT with business goals) or how it supports risk-based audit planning.
The most common mistake is skipping the risk assessment and going straight to auditing technical controls. Without understanding the risks and business objectives, the audit may focus on low-priority areas and miss critical issues.
Materiality is determined by the impact on business objectives. A weakness that could cause a major financial loss, regulatory penalty, or reputational damage is material. The auditor uses professional judgement and consults with management to set the threshold.
Yes, the audit plan can change if new significant risks are discovered during the audit. However, any changes must be formally documented and approved by the audit committee or appropriate management. Unauthorised changes are considered scope creep.
The audit committee oversees the internal audit function. They approve the overall audit plan, review significant findings, and ensure the audit function remains independent. They do not perform the audit itself but provide governance.
You've finished Audit Planning and Risk Assessment. Continue through the CISA study guide to build a complete picture of the exam.
Done with this chapter?