Accountio / Templates / Risk and internal audit / Internal audit plan

Internal audit plan template in Excel, with a three-year cycle

List every area the business could audit, rate each one by risk and let the workbook set which year each audit falls in. This internal audit plan template is one Excel workbook with an audit universe of 80 rows, a plan summary that sets days needed against days available, and a findings tracker that flags overdue actions.

Finance teams
$19
In the pack
Risk and internal audit pack
Files
4, Word and Excel
Buy the pack · $19
Global library · 101 packs

Get this pack and 100 more for $129

Risk and internal audit · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the plan looks like

Internal audit plan template
What the plan coversSheet or column in the workbook
When the plan starts and how much time you have
✓
SettingsFirst day of year 1, audit days available each year and how often each risk rating is audited
How often each area is audited
✓
Risk rating, Audit every (years)High every year, Medium every two years, Low every three, all changeable
Every area you could audit
✓
Audit universeAuditable area, scope and the risk register IDs it links to, with 12 example areas
When each audit is due
✓
Last audited, Cycle (years), Next due, First plan yearAreas never audited fall in year 1
The three-year plan
✓
Year 1, Year 2, Year 3Marked Yes for each year the area is audited
Who does it and when
✓
Days per audit, Quarter (year 1), LeadYear 1 audits need a quarter
What is missing on each row
✓
CheckArea and rating, a link to the risk register, days needed or a quarter
Capacity against the plan
✓
Plan summaryAudits planned, days needed, days available and high-risk areas covered each year, with the days over
Audit findings followed up
✓
Findings trackerFinding, rating, agreed action, owner, due date, status, date closed and days overdue
Sign-off
✓
Approved by the audit committee or board onThe plan is approved each year

When you need an internal audit plan

An internal audit plan sets out which parts of the business internal audit will review, in which year and with how many days, so the highest risks are checked most often. The audit committee or board approves it and follows up the findings. Use this one when:

  • You are setting up internal audit for the first time and need a plan to take to the audit committee
  • The plan lives in a slide deck and nobody can say when each area was last audited
  • There are more audits on the list than days in the year
  • Actions agreed after audits are not followed up

How to use the internal audit plan template

  1. Fill in Settings. Enter the first day of plan year 1 and the audit days you have each year. Change how often each rating is audited if your committee wants a different cycle.
  2. Build the audit universe. One row per area, with its scope, the risk register IDs it links to, a High, Medium or Low rating and when it was last audited. Leave the date blank if it never was.
  3. Add the days for each audit. The plan years fill in for you. Choose a quarter and a lead for each audit in year 1.
  4. Check the Plan summary. If the days needed are more than the days available, push lower-risk work back, buy in help or ask for more time.
  5. Track every finding. Log the agreed action, owner and due date after each audit. Take open and overdue actions to every committee meeting.

Questions

What is an internal audit plan?

A schedule of the audits internal audit will carry out, usually over one to three years. It lists each area, why it is included, when it will be audited and the time it needs.

What should an internal audit plan include?

The audit universe of all areas that could be audited, a risk rating for each, how often each is audited, the year and quarter of each audit, the days needed against the days available, who leads each audit and how findings will be followed up.

What is a risk-based internal audit plan?

A plan where the risk of each area decides how often it is audited. In this workbook high-risk areas are audited every year, medium every two years and low every three.

What is an audit universe?

The full list of areas, processes and systems internal audit could review, such as purchase to pay, payroll, treasury, IT controls and tax. The plan is drawn from it.

Who approves the internal audit plan?

The audit committee, or the board where there is no committee. It approves the plan each year and reviews the findings tracker at each meeting.

Also in the risk and internal audit pack

Risk registerFraud risk assessment

See the whole pack →

Who it's for

Heads of internal audit, financial controllers and finance directors in small and mid-sized companies and groups.

Last checked

Checked in November 2026.