Guideline on Establishing the Internal Audit Plan

Guideline on Establishing the Internal Audit Plan

Internal Audit Plan

The internal audit plan details internal audit’s budgeting and planning processes. It is comprised of two parts: multi-year audit plan and the annual audit plan.

Internal audit first prepares a multi-year plan. This plan is driven by two key factors: risk assessment results and internal audit resources. It describes the internal audit objectives, audit goals, a forecast of available audit hours, the planned allocation of audit hours to each type of audit and school board for a five year period given the identified risk areas and the available resources. Changes in risk or audit resources may lead to a change in the plan.

Internal audit then prepares an annual internal plan which describes,in further detail, the audit responsibilities, audit focus and audit direction for the fiscal year.

The internal audit plan will be unique as it will be prepared from a regional perspective and not a district school board perspective. A region includes between six to twelve district school boards.

Developing the Audit Plan

Knowledge of the district school boards in the region

In order to produce value added audit reports, internal audit needs to acquire an in-depth knowledge of the district school boards’ strategic goals and objectives, programs, systems, policies and procedures as well as its management structure. The information which is gathered on an ongoing basis will be one of the major sources for internal audit in identifying risks in auditable entities in the regionwhich will be included in the audit plan.

Defining the audit universe

A general audit universe applicable to district school boards was prepared by the Ministry of Education and is available as part of the risk assessment tool. The audit universe should be tailored to each district school board within the region. It should also be reviewed on an annual basis. All changes, additions and deletions should be captured prior to the beginning of the annual risk assessment process.

Risk assessment for each board

For each district school board in the region,internal audit will use the risk assessment tool provided by the Ministry of Education. This will determine the risk score for each auditable entity for each district school board. This process is repeated for each school board in the region. Based on the score, entities will be assessed as high, medium and low risk. Note that a rating of high risk does not automatically mean that the process, function or activity audited is perceived to have internal control issues. The risk rating considers other factors such as the financial and reputational materiality of the activity to the district school board as a whole. As a note, the risk assessment is a process that is performed annually to reflect changes that have taken place since the last risk assessment.

Based on the risk rating, the regional internal audit manager should aim to cover all the auditable areas with the following frequency:

• High risk areas: within 3 years
• Medium risk areas: within 5 years
• Low risk areas: subject to the availability of resources

Determine the distribution of resources by board

Internal audit will apply the risk assessment for each board against the Resource Allocation Guideline to determine the available resources by board.

Risk assessment summarized by region

The regional internal audit manager will then summarize each completed assessment and plot the results for the region to identify areas that are similar within the region.

Identify Audit Projects

A list of auditable entities will be developed, including the following information required to build the plan:

• The high level audit objective
• Risk score by board
• Auditable entities with similar risk scores for all boards in the region1
• Estimated effort (in hours and weeks) required by the audit team to complete the engagement
• Actual time used where the entity was previously audited
• Input from the external auditors in order to increase audit coverage and avoid any unnecessary duplication of work
• Whether specialist services are needed and, if so, the estimated cost of any such services
• The date and resultof the last audit (if applicable).

1Where logical, multiple auditable entities may be combined into one audit to increase efficiency (such as the human resource functions of recruitment, hiring and termination).

Develop the DraftFive-YearAudit Plan

The following steps should be executed to schedule the auditable entities into the audit plan:

• Determine the total time (in hours and weeks) available for audit related activities each yearby board based on step # 4 above x 5 years (i.e. total work hours in the year less vacation, training/professional development, estimated sick leave, administration, etc.).
• From the figure calculated above, determine the time available to execute audits selected using the risk based approach. The annual audit plan should allocate time for these audit projects, as well as requests from various sources, follow-up on outstanding findings and contingency. See appendix 1 for a sample allocation and further explanation of these various categories.
• Given the available time for these audits, they should be scheduled into the five-year plan based on their risk score:
• Those scheduled in the early years of the five-year plan might be repeated later in the five-year plan.
• The Regional Internal Audit Team (RIAT) should also take into account audits or reviews recently completed or planned (such as operational reviews, external audits). Where planned audits would represent a duplication of effort with these reviews, the auditor should considering rescheduling the audit to later in the five-year plan to maximize coverage.
• Where there is insufficient room in the five-year plan to include all high and medium risk entities, those with the lowest risk score should be removed one by one until there is sufficient room for the remainder of the audits. These audits will be covered in the next five year cycle.
• Once the available hours have been allocated, audits to be conducted by specialists should be added to the audit plan up to the dollar amount designated by the RIAT for these services. High risk audits requiring specialists should take priority. Where the RIAT has opted for an additional allocation for outsourced services, this amount should be used to supplement the risk based audit plan.

Develop the DraftAnnual Audit Plan

Using year 1 of the five-year audit plan as a starting point, the annual audit plan needs to be refined to include items such as requests, contingency and time for follow-up, as outlined in appendix 1.

The timing and coverage of the annual and five-year plan should be discussed with senior management of each district school board for their input and feedback.This discussion may result in requests for specific audits.

The annual audit plan will include a schedule for the year, as well as the details for each audit specified in step #3 above. The multi-year audit plan will list all entities for completeness. For each entity in the multi-year audit plan, the details for each audit will be included, as well as the year in which the audit is scheduled (if in the next five years). The schedule for the annual audit plan will be a preliminary schedule of when each audit will take place based on knowledge of employee vacations, etc. When scheduling the audit, the busy periods for each auditee should be taken into consideration.

Plan Approval

A final draft of the annual and five-year audit plan should bepresented to the audit committee of each district school board, with a brief overview of the methodology used to develop the plan. Each audit committee must satisfy itself that appropriate audit coverage will be provided before recommendingthe audit plan related to their district school board to their respective Board of Trustees for approval. A copy of the approved plan will be provided to the Director of Education and Senior Business Official of each district school board, as well as the Ministry of Education.

The audit committees should monitor the RIAT’s progress against the plan throughout the year. If future adjustment to the plan is necessary, the parties who originally received a copy of the plan should be advised. Presentation to the affected audit committees and approval by their respective Boards will be necessary in cases of significant changes.

Appendix 1: Sample Audit Plan Resource Allocation

Audit Plan Component / Allocation / Explanation
Planned Audits / 75% / Audits selected through the risk assessment and prioritization process.
Requests / 15% / This category would include requests from the Audit Committee, Ministry of Education, etc.This may include planned requests or contingency for unplanned requests (such as fraud investigations). Requests should be within the internal audit mandate and may include consulting engagements, as long as such engagements have the potential to improve management of risks, add value and improve operations and are consistent with the overall values and goals of the district school board.
Follow-up on Outstanding Findings / 5% / Represents approximately one day at each month end to follow-up on open findings and validate closure of closed findings.
Contingency / 5% / Part of the audit plan set aside for other and unforeseen items such as: assistance for external auditors and quality assurance reviews, employee turnover, overruns, etc.
Available Hours / 100% / Total hours available for audit (total hours net of vacation, statutory holidays, PD, etc.).

If the allocation for requests and contingency exceeds the time actually used, additional audits should be added to the annual plan based on time available and risk assessment. This would require the approval of the relevant Audit Committee.

Page 1 of 5