The Annual Risk Assessment

The annual audit plan is the most important artifact the IA function produces. It defines what the function will examine during the year, implicitly defines what it won't examine, and commits the function to specific engagements that will produce specific findings. Every other output — individual audit reports, findings, remediation tracking, audit committee reports — flows from the plan. A well-constructed plan is necessary but not sufficient for a successful function.