02 — Capability · BC-160.10
Audit Planning & Universe
Know everything that could be audited, rank it by risk and build the plan that spends limited audit hours where a failure would hurt most.
- Audit Universe
- Risk-Based Audit Plan
- Audit Charter
In scope
- Audit charter and mandate
- Audit universe and risk ranking
- Annual and rolling audit plan
Out of scope
- The enterprise risk register itself (see BC-130)
Decomposes into · 3
- BC-160.10.10Audit Charter & MandateDefine the function's purpose, authority, independence and reporting line, approved by the board or its audit committee.
- BC-160.10.20Audit Universe MaintenanceKeep the inventory of auditable entities, processes and systems current and rated for risk.
- BC-160.10.30Risk-Based Audit PlanningSelect and schedule engagements for the year from the universe according to risk, coverage history and the resources available.