What's included
An audit plan has two layers: the annual programme and the individual engagement inside it. The template shows both, so the committee sees coverage while the team sees the work:
- Annual planning — Risk assessment, audit universe refresh, stakeholder interviews, resource and budget plan and the draft annual plan. Milestone: plan approved by committee.
- Engagement scoping — Announcement, background research, process walkthroughs, risk and control matrix, and the agreed engagement scope and terms of reference.
- Fieldwork & testing — Control design assessment, sample selection, walkthroughs and substantive testing, evidence collection and working papers.
- Findings & validation — Draft observations, factual accuracy checks with process owners, rating and prioritization, and the closing meeting. Milestone: closing meeting held.
- Management response — Agreement of actions, named owners and target dates, and escalation of anything management declines to accept.
- Reporting — Draft report, quality review, final report issue and presentation to the audit committee. Milestone: report issued.
- Follow-up — Tracking remediation against agreed dates, verification testing of closed actions and reporting overdue items back to the committee.
How to customize it
- Lay several engagements side by side across the year to see whether your team is genuinely available for all of them.
- Set the audit committee meeting dates first — they are fixed, and every report date works backwards from one of them.
- Add a row per auditable entity if you report coverage of the audit universe to the committee.
- Extend fieldwork for engagements needing site visits or data extracts; both take longer than desk-based testing.
- Include a contingency or special-investigation allowance; unplanned work is normal and unbudgeted unplanned work destroys the plan.
- Track each finding's remediation date as its own task once the report is issued, rather than as a spreadsheet elsewhere.
Scheduling tips
- Build the plan on risk, then check the coverage. A risk-ranked plan that quietly ignores a whole business unit for three years is the finding the external auditors will make about you.
- Announce early and get the walkthroughs booked. Auditee availability is the most common reason fieldwork overruns, and it is entirely predictable.
- Validate facts before you rate findings. A factual error found after rating costs the report its authority and adds a full review cycle.
- Do not let management response drift. Give it a bounded bar with a deadline; open-ended response periods are how reports miss committee dates.
- Re-test rather than re-ask. Verification of a closed action should involve evidence, which needs time on the schedule, not just an email confirmation.
- Baseline at plan approval. Track variance against the approved plan so unplanned work is visible as displacement, not absorbed silently.
Related templates
- Project Management Gantt Chart Template
- Free Yearly (12-Month) Gantt Chart Template
- Post-Merger Integration Plan Template
- Browse all Gantt chart templates
Frequently asked questions
What should an internal audit plan include?
A risk assessment and audit universe, a ranked list of engagements with resourcing, and for each engagement scoping, fieldwork, findings, management response, reporting and follow-up. All seven phases are pre-loaded.
How long does a single internal audit engagement take?
Commonly 6–12 weeks from announcement to issued report for a mid-sized review, with follow-up running for months afterwards. The engagement in this template runs about four months end to end.
How often should the annual plan be refreshed?
Most functions approve the plan annually and revisit it at least half-yearly, since risk profiles and unplanned work both move. Leaving contingency in the plan is what makes that revisit manageable.
Can I use this for an external audit or a certification audit?
Partly. Scoping, fieldwork, findings and follow-up map across well; you would replace the annual planning phase with the certification body's own audit cycle.
Is the internal audit plan template free?
Yes. Free Excel, PowerPoint and CSV downloads, and free online editing with no sign-up required.