Use this once per cycle and again when scope, frameworks or the risk picture change materially. You get three files in a new folder, ./internal-audit-programme-planning/: a short plan document saying what gets audited, why, by whom and how findings are followed up (programme.md), a spreadsheet you can open in Excel showing every audit area against each year of the cycle (coverage-matrix.csv), and a second spreadsheet with the proposed audit dates and auditors (calendar.csv). This skill drafts for a human to review and sign; this skill never marks a control effective. Leadership approves the programme; the skill proposes it.

Inputs to gather

Read the scope statement, the list of processes and controls in scope (applicability statement or control list), the risk register, previous internal and external audit reports with open findings, the incident log, the org chart, and the external audit dates. Ask the reader in one message: which frameworks and how many sites or legal entities are in scope, the external audit or examination window, who could act as auditor (internal staff, a peer from another team, a contracted auditor), and the budget in days.

Step 1: list the audit areas

Group the scope into 8 to 15 auditable areas a person can cover in half a day to two days each: governance and leadership, risk management, people (joiners, movers, leavers, training), access management, change and development, operations and monitoring, incident management, continuity and backup, suppliers, privacy processes, AI system lifecycle, physical sites. Keep the management system processes (scope, leadership commitment, objectives, competence, document control, internal audit itself, corrective action, management review) as their own area; they are audited too. When several management system standards are in scope, add each one's own areas, such as privacy risk assessment or AI impact assessment.

Step 2: rank each area by audit risk

Score each area 1 to 3 on four factors and add them:

Inherent risk: the highest residual score of the risks the area treats.
Change: new systems, new teams, reorganisation, new framework since the last audit.
History: open or repeat findings, incidents traced to the area.
Evidence weakness: controls that are claimed but thinly evidenced.