Older-style internal audit worked through a fixed checklist regardless of where the real risk sat. Risk-based internal audit, the approach mandated by IIA Standards and used in every BAC Practice engagement, starts from a different question: where could this organisation actually be hurt, and how badly?
Step 1: Building the Audit Universe
Before any fieldwork begins, we map the full range of auditable areas across the organisation — procurement, payroll, revenue, IT systems, grant management, and so on. This is the audit universe, and it forms the basis of the annual audit plan.
Step 2: Risk Assessment
Each area in the audit universe is scored against likelihood and impact — how likely is a control failure here, and how damaging would it be if it happened? Factors considered include the size of the financial exposure, history of past issues, regulatory sensitivity, and the maturity of existing controls. Areas with the highest combined risk score get prioritised first.
Step 3: Scoping the Engagement
The risk assessment shapes a focused engagement plan — clear objectives, specific programme areas, and a realistic timeline. This is also where the engagement letter is signed, setting out scope, fees, and what both sides can expect.
Step 4: Fieldwork and Testing
Auditors gather evidence through a mix of methods — inspection of documents, observation of processes, inquiry with staff, recalculation of figures, and, increasingly, data analytics across full transaction populations rather than small manual samples. Every test result is documented in a working paper, reviewed by a senior team member before it is relied upon in the report.
Step 5: Findings, Not Just Observations
A proper finding has four parts: what was found, the root cause behind it, the risk it creates, and a specific, actionable recommendation. Vague findings like "improve controls" help no one — every BAC Practice finding names exactly what should change and who is responsible for changing it.
Step 6: Follow-Up
The engagement does not end at the report. A follow-up review tracks implementation progress against each recommendation until it is verified closed with evidence — not just a management assertion that it has been handled.
A risk-based approach means your audit hours go where they protect the most value, not where a generic checklist happens to point.
If your organisation has never had a risk assessment done, that is usually the right place to start — even before a full audit engagement. Get in touch to discuss what a risk-based audit plan would look like for you.
