A finding lands on the desk of the head of finance, and the reply comes back in three parts. Why was this area audited at all? How many records were checked? What proves it? An auditor who can answer all three calmly has a finding that holds up. An auditor who cannot has an argument. The strongest findings are the ones where all three answers were settled before fieldwork began.

What is an audit plan?

An audit plan is the document that sets out which audits an internal audit function will carry out over a period, usually a year, and why those areas were chosen.

The Institute of Internal Auditors (IIA) defines it in the Global Internal Audit Standards, which were issued January 9, 2024 and became effective January 9, 2025. The Standards define the internal audit plan as “A document, developed by the chief audit executive, that identifies the engagements and other internal audit services anticipated to be provided during a given period. The plan should be risk-based and dynamic, reflecting timely adjustments in response to changes affecting the organization.”

In everyday terms, the plan is a ranked list of where audit time will go. A small team cannot audit every process in a year, so the plan picks the areas where a failure would cost most, such as payments to new suppliers, leaver access to customer data or a recently launched inventory system. Risk register scores, open findings and control test results can all feed that ranking, as Ideagen’s post on using data to plan, predict, detect and evidence in internal audit sets out.

Under Standard 9.4, the chief audit executive must base the plan on a documented assessment of the organization’s strategies, objectives and risks, performed at least annually. The board must approve the plan and any significant changes to it. The plan does not promise to test everything. It records what will be covered, which resources are needed and the rationale for leaving out any high-risk area.

What is audit sampling?

Audit sampling is testing fewer than all items in a population and using the results to draw a conclusion about the whole population.

International Standard on Auditing 530, written by the International Auditing and Assurance Standards Board for external audits of financial statements, defines it as “The application of audit procedures to less than 100% of items within a population of audit relevance such that all sampling units have a chance of selection in order to provide the auditor with a reasonable basis on which to draw conclusions about the entire population.” Internal auditors apply the same idea under the IIA Standards, where the guidance on the engagement work program (Standard 13.6) says that when sampling is used, “the work program should include the sampling methodology, population, sample size, and whether the results can be projected to the population.”

In everyday terms, an auditor who checks 60 of 5,000 expense claims is sampling. The 5,000 claims are the population and the 60 are the sample. Sampling risk is the risk that the conclusion drawn from the sample differs from the conclusion that testing every claim would have produced.

Approach How items are chosen What it supports
Statistical sampling Random selection, with probability theory used to evaluate the results A measured level of sampling risk and a conclusion about the whole population
Non-statistical sampling The auditor selects items using knowledge of risk, such as high values or unusual dates Focused testing without a statistical measure of sampling risk
Targeted testing Every item that meets a risk criterion is tested Full coverage of a defined high-risk group and no conclusion about the rest

Statistical sampling

Each item has a known chance of selection, so a clean result across 60 randomly chosen supplier invoices supports a measured statement about all invoices in the period.

Non-statistical sampling

An auditor reviewing journal entries might pick every entry posted on a weekend or above a set value. The choice is deliberate, which makes it efficient for known risks and harder to project to the rest of the population.

Targeted testing

If 14 payments sit just below an approval limit, the auditor tests all 14. Nothing is left to chance, but the result says nothing about payments that did not meet the criterion.

What is audit analytics?

Audit analytics is the use of data analysis tools to test entire datasets, and not only samples, for patterns that point to error, fraud or control failure.

In everyday terms, an analytics test asks the same question of every record. Did any supplier get paid twice for the same invoice? Did anyone approve payments just under their limit? Does a leaver’s account still show activity after their end date? The IIA Standards treat analytics as part of normal evidence work, listing workpapers that document “data analytics programs or software used, test populations, sampling processes, and sampling methods” as examples of evidence of conformance with Standard 14.2.

Audit area Analytics test What it can reveal
Accounts payable Match supplier, amount and date across all payments Duplicate payments
Procurement Group purchases by supplier and approver, then compare with approval limits Orders split to stay under a limit
Payroll Compare employee bank details with supplier bank details Conflicting or ghost records
Journal entries Filter for weekend postings and users who rarely post Unusual or unauthorized entries
Access management Compare end dates with last login dates Leaver accounts that stayed active

An analytics result is a list of exceptions, and an exception is not a finding until an auditor has investigated it. Many have an innocent explanation, such as a legitimate repeat order or an out-of-hours month-end close.

What is audit evidence?

Audit evidence is the information an auditor gathers and evaluates to support a conclusion, so that another auditor could follow the trail and reach the same place.

Standard 14.2 of the IIA Global Internal Audit Standards requires internal auditors to evaluate whether information is relevant, reliable and sufficient. The Standards define the three tests this way:

  • Relevant: “consistent with engagement objectives, within the scope of the engagement, and contributes to the development of engagement results.”
  • Reliable: “factual and current.”
  • Sufficient: “when it enables internal auditors to perform analyses and complete evaluations and can enable a prudent, informed, and competent person to repeat the engagement work program and reach the same conclusions as the internal auditor.”

The Standards add that reliability is strengthened when information is obtained directly by an internal auditor or from an independent source, and when it is corroborated. A single statement from the person running the control carries less weight than a system report the auditor pulled directly.

Documents and records

Contracts, approvals, invoices and policy documents show what was supposed to happen and what was recorded.

Observation

Watching a process run, such as goods being received and checked against an order, shows what happens in practice.

Inquiry

Interviews explain why a process works as it does. They carry the most weight when documents or system data corroborate them.

Re-performance

The auditor repeats a control independently, such as recalculating an accrual, and compares the result with the original.

System data and analytics output

Reports and logs pulled directly from a system, with the test and its results recorded, give evidence that is repeatable and traceable.

A duplicate payments finding from plan to proof

The figures in this scenario are illustrative. An internal audit team at a mid-sized distributor works through the four terms in order:

  • Plan. Payments to new suppliers rose sharply during the year and the supplier onboarding control has not been tested since the last audit cycle. Supplier payments rank high in the plan, and the audit committee approves the engagement.
  • Analytics. The team tests every payment in the year for matching supplier, amount and date. The test returns 40 exceptions.
  • Sampling. The onboarding control is tested on a random sample of 25 of the 300 new supplier files, with the methodology, population and sample size recorded in the work program.
  • Evidence. Each exception is traced to an invoice and a bank record. Thirty-one are legitimate repeat orders, nine are genuine duplicates and six of those have already been recovered. A second auditor repeats the match on three of the nine and reaches the same result.

The finding then states the criteria, condition, cause, effect and recommendation, as laid out in Ideagen’s post on the audit finding, charter and control self-assessment. When the finance team challenges it, each answer is on file: the plan shows why suppliers were audited, the work program shows how much was tested and the exception log shows what proves it.

How the four differ by purpose, owner and timing

Term Purpose Owner Timing
Audit plan Decides which areas get audited and with what resources Chief audit executive, with board approval Risk assessment at least annually, then updated as risks change
Audit sampling Tests part of a population to conclude on the whole Auditor performing the engagement Designed in the work program and applied in fieldwork
Audit analytics Tests whole datasets for exceptions Auditor performing the engagement Planning to focus effort, fieldwork to test populations
Audit evidence Supports each conclusion in the finding Auditor who gathered it, with supervisory review Throughout the engagement, recorded in workpapers

Where each approach falls short and how to check it worked

  • Audit plan: a plan built on stale risk data ranks the wrong areas. Compare it with the latest risk assessment and confirm there is a documented reason for any high-risk area left out.
  • Audit sampling: a sample can miss an isolated exception, which is sampling risk. Confirm the work program records the methodology, population, sample size and whether results can be projected, and that the population was complete.
  • Audit analytics: a test is only as good as its data. Reconcile the extract to a control total before testing, and ask whether a test that never fires is pointed at the right data.
  • Audit evidence: interviews alone are the weakest form of support. Ask whether a second auditor could repeat the work and reach the same conclusion.

Keeping the answer to every challenge on file

A finding earns its weight before fieldwork starts. The plan records why an area was chosen, the sampling or analytics approach records how much was tested and the evidence records what the tests showed. When those records sit together, a disputed finding can be defended from the file and not from memory. Teams that want planning, control testing and reporting connected can look at Ideagen’s internal audit solution.

Frequently asked questions

How large should an audit sample be?

There is no single correct number. Sample size depends on the size of the population, the risk involved and how many exceptions the team will tolerate before changing its conclusion. The IIA Standards say the work program should record the sampling methodology, population, sample size and whether results can be projected, so the choice can be justified later. Higher risk usually justifies a larger sample.

Does internal audit use the same sampling standard as external audit?

Not exactly. International Standard on Auditing 530 applies to external audits of financial statements. Internal auditors follow the IIA Global Internal Audit Standards, which say the work program should include the sampling approach when sampling is used. The concepts overlap, including population, sample size and sampling risk, so the ISA 530 definitions are a useful reference.

What is the difference between audit evidence and workpapers?

Audit evidence is the information that supports a conclusion. Workpapers are the records that document the analyses performed on that information, including test populations and sampling methods. The IIA Standards list such workpapers as examples of evidence of conformance, which is why a well-kept workpaper lets a reviewer follow the trail from finding back to proof.