Phases of Internal Audit
Building the Audit Universe
Multi-Year Risk-Based Planning
What Do We Know?
100

This phase focuses on evidence gathering and fieldwork.

What is examination?

100

The population of all possible audit subjects.

What is the audit universe?

100

This document outlines organizational goals and key risks.

What is the strategic plan?

100

The planet closest to the sun.

What is Mercury?

300

Audit conclusions and recommendations are communicated in this phase.

What is reporting?

300

Used to prioritize units for audit based on risk.

What is a risk matrix?

300

A plan spanning 2–3 years is based on this principle.

What is risk prioritization?

300

This animal can’t jump.

What is an elephant?

500

This final phase tracks remediation and follow-up.

What is monitoring?

500

This aligns each audit unit with key organizational risks.

What is risk mapping?

500

Flexibility in the plan allows for these surprises.

What are emerging risks or unplanned events?

500

Plants absorb this gas from the atmosphere.

What is carbon dioxide?