—IIA 2024 · Domain IV
Risk-based audit planning under the IIA 2024 Standards.
Planning under the 2024 Standards runs from a strategy, through a risk-based plan the board approves, down to a work program the CAE signs off before fieldwork starts. Each layer should be traceable to the one above it.
—What the Standards Require
The requirements, in plain terms.
Standard 9.2
Internal Audit Strategy
A strategy with a vision, strategic objectives and initiatives, reviewed periodically with the board and senior management.
Standard 9.4
Internal Audit Plan
A risk-based plan that stays dynamic; the board approves the plan and any significant changes to it.
Standard 9.5
Coordination and Reliance
Coordinate with other assurance providers and document the basis for relying on their work — the CAE remains responsible for the conclusions.
Standard 8.2
Resources
The CAE assesses whether resources are sufficient and informs the board if not; the board discusses sufficiency at least annually.
Standard 13.6
Work Program
A documented work program — criteria, tasks, methods, tools and assignments — approved by the CAE before use, with changes approved too.
—In Practice
What it looks like when it's done well.
A plan that survives contact with the year
A plan that ignores capacity becomes a list of what didn't get done. Matching the plan to real resources — and telling the board when they fall short, as 8.2 expects — keeps it credible.
Changes go back to the board
Standard 9.4 expects the board to approve significant changes. Keeping a change log against the approved plan makes that conversation a report, not a reconstruction.
Reliance is documented, not assumed
Where the plan leans on second-line or external assurance, Standard 9.5 expects the basis for reliance to be written down. Coverage maps that show who assures what make that visible.
—Evidence of Conformance
What an assessor will ask to see.
A documented internal audit strategy reviewed with the board (9.2)
The board-approved plan, plus approvals of significant changes (9.4)
A documented basis for relying on other assurance providers (9.5)
Board discussion of resource sufficiency at least annually (8.2)
CAE-approved work programs for each engagement (13.6)
How ControlVista Supports It
VistaPlan — Planning & Scheduling
VistaPlan builds the annual and multi-year plan from the risk-ranked universe, with coverage rotation, resource and skill capacity, approval workflow and plan-versus-actual variance.
—Further Reading
From our resources.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
Does the board have to approve changes to the audit plan?
Significant changes, yes. Standard 9.4 expects the board to approve the plan and any significant changes to it.
Must the work program be approved before fieldwork?
Yes. Standard 13.6 expects the CAE to approve the work program before it is used, and to approve changes to it.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.