Formation of an Internal Audit Universe
An internal audit universe is the collective grouping of auditable areas, units, or entities that support the development of the internal audit plan and help to identify appropriate internal control coverage in a prioritised manner. The internal audit universe in a risk-based frame is not construed merely by operating entities. It besets the organisation’s strategic plan and the relevant controls that management has put in place to mitigate risks, meet organisational goals and objectives, and ensure customer needs are being fulfilled.
GRC Internal Auditors can formulate an internal audit universe that is organised by geo-graphic locations, functions, or business processes and comes right after performing a risk assessment. Having an internal audit universe brings the following advantages to an organi-sation:
- It aids in the mapping of various risks, internal controls, and regulations to each business unit;
- It informs the company’s risk management practices and strategic internal audit plan;
- It enables the internal audit activity to be clear about the extent of coverage of the organisation each year;
- It provides a degree of rigour and transparency around areas not being audited and helps inform and support decisions over the internal audit activity’s resourcing requirements;
- The internal audit function will improve their knowledge of all parts of the organisation including not only the risks and controls but also the business strategies, therefore, improving commercial awareness;
- The internal audit function will better understand the roles of each department or function within an organisation to help start discussions where there may be control gaps or duplicated effort;
- The internal audit function can determine which department or functions are already providing assurance within your organisation and develop an approach to determine if internal audit can rely on their work;
- The internal audit function can better determine their future headcount and skillset requirements including possible hiring, or co-sourcing to obtain a skill-set.
Keeping an internal audit universe is not a requirement of professional internal audit practice, however; having an internal audit universe has proven to be beneficial for many organisations.