It’s the middle of November. The audit committee meets in three weeks.
The head of internal audit opens last year’s plan, saves it as “2027 draft” and starts changing the dates. Payroll moves from March to April. The IT audit gets pushed back again. Two audits that never happened this year roll forward.
By Friday there is a plan. It looks busy. It fills the days available. And it is almost entirely about last year’s risks.
We see this every year, in organisations of every size. Not because people are careless, but because November is busy and copying is quick. The trouble is that a lot has moved since this year’s plan was written. And the plan is the one document that decides where your assurance goes for the next twelve months.
So here is how we would build a 2027 plan, step by step, and what we would make sure it covers.
What the Standards actually expect
The Global Internal Audit Standards have applied since January 2025. On planning, they come down to a few plain expectations:
- The plan is based on a documented assessment of the organisation’s strategy, objectives and risks. Not on last year’s plan.
- The board and senior management have a say. Their views go into the risk assessment.
- You are honest about gaps. If a high risk area is not covered, or you don’t have the resources to cover it, the board needs to hear that from you.
- You coordinate with other assurance providers, so you are not auditing what someone else already checks and nobody is checking the gaps.
There is also something newer. The IIA has started issuing topical requirements, which set minimum expectations when certain topics are in your plan. Cybersecurity has applied since February 2026, and more are following, including third party risk. They don’t tell you what to audit. But if a covered topic is in your plan, your work on it needs to meet that baseline.
How we would build it, step by step
1. Start with the strategy, not the risk register
Before you look at a single risk score, read three things: next year’s business plan, the budget, and the last six months of board minutes.
That is where the real changes show up. A new system going live in spring. A big contract with a new supplier. A restructure. A price increase that sales are nervous about.
Risk registers are useful, but they often lag. The board minutes tell you what the people running the organisation are actually worried about.
2. Talk to people before you write anything
Book short conversations with the people who own the risks. The finance director, operations, HR, IT, procurement, and the audit committee chair. Ten or twelve conversations is usually enough.
Ask simple questions:
- What has changed since last year?
- What keeps you up at night?
- If something went badly wrong next year, where would it be?
- Where do you feel you have the least visibility?
The answers are rarely surprising. But they tell you where people feel exposed, and they make the plan feel like it belongs to the organisation, not just to internal audit.
3. Map who already gives assurance
Before choosing audits, list who else is already looking at each area. Compliance, health and safety, the risk team, external audit, regulators, certifications like ISO 27001.
A simple grid works: the main risks down the side, the assurance providers across the top. Two things jump out quickly. Areas that are checked three times over, and areas nobody checks at all. Your plan should lean towards the second group.
4. Choose the audits
We find it helps to sort the plan into three groups:
- Core work. Areas that need regular coverage because the risk never really goes away, like key financial controls or payroll.
- Risk driven work. The areas that came out of steps one to three. This is where most of next year’s value sits.
- Follow up. Checking that agreed actions from earlier audits were actually done. This often gets cut. It shouldn’t.
Then hold some days back. Something will come up that nobody expected. We usually suggest keeping around a tenth of the days unallocated, so you can respond without dropping something else.
5. Be honest about resources
This is the step most plans skip.
If your risk assessment says you need 400 days of work and you have 250, don’t squeeze it in by shrinking every audit. Show the committee what is covered, what is not, and what the gap means. Then let them decide whether to accept the risk, fund more days, or bring in outside help.
The Standards expect this conversation. And in our experience, committees respect a plan that is honest about its limits far more than one that quietly promises everything.
6. Make it a living plan
An annual plan written in November is out of date by March. Treat it as rolling.
Look at it again every quarter. Ask what has changed, what has dropped in priority, and what needs to come in. Report the changes to the audit committee so they can see the plan moving with the business.
Many heads of audit already work this way. Risk in Focus 2026/2027 surveyed nearly 800 chief audit executives across Europe, including the UK. It describes one who moved from a yearly cycle to reassessing risks every three months, rewriting the plan as needed.
What to watch out for in 2027
The same survey shows a gap between what heads of audit rate as a top risk and where they actually spend their time. That gap is a good place to look when you build your plan.
AI and new technology. It ranks second for risk, but only eighth for audit effort. In many organisations, AI tools are already being used in finance, HR and customer service, often without anyone owning the risk. Even a short review of how AI is being used, who approved it, and what data goes into it would be a sensible start.
Geopolitics, tariffs and costs. Third for risk, fifteenth for effort. You may not audit “geopolitics”, but you can audit what it hits: supplier concentration, pricing decisions, contract terms, and the forecasts the board relies on.
Cyber and data. Still the top risk, named by 86% of chief audit executives. If it is in your plan, check your approach against the IIA’s cybersecurity topical requirement.
Fraud. Here is the surprise. Fraud ranks only thirteenth out of sixteen. Yet in the UK, the failure to prevent fraud offence has applied to large organisations since September 2025. If your organisation is in scope and nobody has tested its fraud prevention procedures, that belongs in your plan.
Third parties. Suppliers, outsourced services and agents now carry a lot of your risk. A third party review is often one of the most useful audits on the plan.
Material controls (listed companies). For financial years starting on or after 1 January 2026, Provision 29 of the UK Corporate Governance Code asks boards to declare whether their material controls are effective. The first of those declarations will appear in 2027. If that applies to you, your plan should help the board stand behind it.
The traps we see most often
- A plan built by department, not by risk. It looks tidy, but it misses risks that sit between teams.
- Too many audits for the days available. Every audit becomes thinner, and nothing gets covered properly.
- No room for advisory work. Some of the most useful things internal audit can do in 2027 are early: reviewing a new system before it goes live, or a new policy before it is signed off.
- No contingency. The first surprise of the year knocks the whole plan over.
- Approved and then forgotten. If the plan is never revisited, the committee has no idea whether it still makes sense.
A quick check before your audit committee approves the plan
Can you answer yes to these?
- The plan is built on a fresh risk assessment, not last year’s plan.
- Senior management and the committee chair gave their views.
- We know which areas other assurance providers already cover.
- High risk areas we are not covering are clearly listed.
- The committee can see the effect of our resource limits.
- AI, fraud and third parties have been considered, not just assumed.
- Around a tenth of the days are held back for the unexpected.
- We have agreed when the plan will be reviewed during the year.
If you answered no to more than two, there is still time to fix it before the plan goes to committee.
Need a second pair of eyes?
Whether you have an in house team that wants an independent challenge, or no internal audit function yet, we can help you build a 2027 plan that reflects where your risks are today. If you are building the function itself, our guide on how to set up an internal audit function is a good place to start.
Book a free 20 minute call and we will talk through where you are. You can also read more about our outsourced and co sourced internal audit, internal audit set up and fraud risk assessment services.
Frequently asked questions
How often should an internal audit plan be updated?
At least once a year, but we recommend reviewing it every quarter. Risks change during the year, and the plan should change with them. Any significant changes should be reported to the audit committee.
How many audits should be in an internal audit plan?
There is no right number. It depends on your risks and the days available. A smaller plan with properly resourced audits is better than a long list of thin ones.
Who approves the internal audit plan?
The board, usually through the audit committee, approves the plan after it has been discussed with senior management.
What is a risk based internal audit plan?
A plan where the audits are chosen because of the organisation’s most significant risks, rather than a fixed rotation where every area is audited every few years regardless of risk.
Can a small organisation without an internal audit team have an audit plan?
Yes. Many smaller organisations outsource or co source internal audit. The planning steps are the same, just scaled to the size of the organisation. If you are starting from scratch, our internal audit set up service covers the charter, the methodology and your first risk based plan.
Sources
- The IIA, Global Internal Audit Standards (effective 9 January 2025) and topical requirements
- ECIIA and Chartered IIA, Risk in Focus 2026/2027
- Financial Reporting Council, UK Corporate Governance Code 2024
- Home Office, guidance to organisations on the offence of failure to prevent fraud (2024)
