What is a multi-year audit plan
A multi-year audit plan is a rolling forecast of proposed assurance and advisory work across several years. It connects risk, prior coverage, resources, and skills so leaders can see how today’s choices may affect future assurance. The forecast remains flexible as organizational objectives and operating conditions change. For some organizations, a multi-year plan also fulfills a regulatory requirement. Effective multi-year planning depends on a sound risk assessment and professional judgment.
A multi-year audit plan example
Imagine that a three-year forecast places a third-party risk audit next year while an ERP review is scheduled for the current year. A serious supplier incident changes the picture. Internal audit may bring the third-party work forward and narrow or move the ERP review. The annual plan reflects the immediate change, and the multi-year forecast shows what it means for future coverage and capacity. Significant changes to the approved plan still need to be discussed with the board and senior management and approved by the board under the IIA's Global Internal Audit Standards. A quarterly review provides a regular checkpoint, while material events can prompt a change sooner.
What should a multi-year audit plan include
A useful forecast begins with an audit universe that reflects how the organization operates and what it is trying to achieve. For each area, the team needs enough information to understand current risk, prior audit coverage, other sources of assurance, and any audit cycle or regulatory expectation that affects timing. From there, the plan can show potential engagements, estimated effort, needed skills, dependencies, and the reason for placing work in a particular period. Work that has been deferred or had coverage reduced should be visible too.
The IIA’s Standard 9.4 requires the CAE to base the audit plan on a documented assessment of strategies, objectives, and risks at least annually, and to update the plan as circumstances change. A multi-year forecast can make that process more informed, but it does not replace the need for an up-to-date risk assessment or the approved annual plan. The forecast shows how annual planning decisions add up over time.
Meeting regional and industry requirements
Regional and industry driven regulations can be a direct reason to adopt multi-year audit planning. The obligation depends on the jurisdiction and the type of institution. Audit leaders need to identify the rules that apply to each entity, including the required planning horizon, review frequency, and approval process.
The financial sector illustrates how regulation can drive multi-year audit planning. In some EU jurisdictions, including Luxembourg, covered financial institutions must maintain an audit plan spanning several years and review it annually. US supervisory guidance also recognizes multi-year planning with a 3- or 4-year audit cycle as a commonly practiced approach to achieving appropriate risk coverage, while allowing an annual risk-assessment framework. A longer planning horizon helps audit leaders align regulatory commitments, resources, and emerging risks while retaining flexibility as conditions change.
Even a required multi-year plan can still support agile auditing. Audit leaders can adjust priorities as risks change while meeting applicable coverage and approval requirements. Recording mandatory reviews, deadlines, and the reasons for changes helps the team see which work can move and where additional capacity may be needed. A longer horizon brings regulatory commitments and emerging risks into the same planning conversation.
Documenting planning assumptions
A multi-year audit plan is only as reliable as its assumptions. Organizations should document key assumptions such as staffing levels, reliance on co-sourcing partners, anticipated business transformation initiatives, expected regulatory activity, significant technology investments, and planned assurance from other functions.
Clear assumptions make future changes easier to evaluate and explain. When priorities shift, leaders can determine whether the change resulted from an updated risk assessment, a change in resources, a business event, or an inaccurate planning assumption. Documented assumptions strengthen planning discussions with audit committees and executive stakeholders.
Seeing the gaps an annual plan can hide
An annual audit plan can be entirely reasonable on its own and still leave an important gap when viewed over several years. An annual plan highlights the most urgent work, but audits repeatedly displaced by emerging risks are easier to forget. A rolling view shows when an area was last reviewed, when it might be covered again, and how often it has been deferred. The history helps the CAE distinguish a deliberate decision from a gap that has simply accumulated.
Risk-based internal auditors focus on whether the organization’s most significant risks receive appropriate assurance. Audit leaders also need to see which risks, processes, and entities have been reviewed and which remain unreviewed. The multi-year view connects coverage across the audit universe to business objectives and risk rather than a fixed departmental rotation.
A changing, high-risk area may require more frequent or deeper work. A stable, lower-risk area may call for a narrower review, ongoing monitoring, or reliance on another assurance provider whose work internal audit has evaluated. Some regulated organizations must also meet specific cycle commitments. Viewing these demands together makes it easier to balance regulatory expectations with newly emerging risks rather than treating audit cycles as the sole reason for scheduling work.
Suppose a procurement audit is moved twice to accommodate cybersecurity work. The cybersecurity priority may be sound, but the longer-term view makes the procurement gap visible. The CAE can decide whether to narrow the procurement scope, draw on other assurance, add capacity, or explain the remaining exposure to the audit committee. The discussion turns to risk and assurance, with the schedule change explained in context.
Spending less time rebuilding the audit schedule
Many teams first model several years of work in spreadsheets. A small audit universe may make the approach manageable, but maintaining the schedule becomes harder as risk ratings, prior audit dates, cycle rules, and staffing assumptions change. A revised assessment in one file may not reach the schedule in another, and the board presentation may reflect yet another version. The work of reconciling those views can crowd out the discussion the plan is meant to support.
A structured process can use consistent data and defined scheduling assumptions to produce a starting forecast. It can bring a cycle deadline, an overloaded quarter, or an area without planned coverage to the team's attention. Auditors can then spend more time deciding whether those results still make sense. Automation is helpful for repeated calculations, but it cannot judge the risk of an acquisition, the quality of another assurance provider's work, or the right moment to review a changing process. Audit leaders make those decisions and document the reasoning so they can revisit it later.
Making decisions easier to explain
Planning across several years exposes differences that can be difficult to spot in an annual list. Two areas with similar risk ratings might have very different audit schedules. One area could have strong monitoring by another function, while the other is undergoing rapid change. If the plan records the latest assessment, the scope of prior assurance, the proposed review trigger, and the rationale for moving an audit, a future reviewer can understand the difference without reconstructing old conversations.
Consistent planning applies the same basic questions across the audit universe and records where professional judgment leads to a different answer. A clear record builds confidence in the forecast because the assumptions can be challenged and updated. It also helps when leadership changes or a risk that once seemed distant becomes more pressing.
Giving the audit committee the longer view
Audit committee updates often center on what the team completed, delayed, or added this year. Completion and delay measures matter, but they say less about what has been left outside the plan. A multi-year view can show the effect of moving an engagement, the areas still awaiting assurance, and the resources it would take to close a meaningful gap. Instead of discussing only whether internal audit is on schedule, the committee can discuss whether expected coverage aligns with the organization's risk profile.
Standard 9.4 calls for timely communication about resource limitations, the reasons for omitting assurance in a high-risk area, and significant plan changes. A rolling forecast helps surface those issues before a missed review becomes a surprise. For organizations required to maintain a multi-year plan, the forecast also helps explain how proposed changes affect regulatory commitments. A concise committee presentation includes the approved annual plan, a longer-term forecast, material gaps, key assumptions, and what has changed since the prior discussion.
Preparing for the skills the plan will require
The constraint on an audit plan is rarely just the number of available hours. A function may have enough capacity overall but not the right expertise at the right moment. Looking ahead can reveal several technology, cybersecurity, analytics, or data-intensive engagements arriving at the same time, giving the CAE an opportunity to develop staff, arrange co-sourcing, adjust timing, or make a more informed resource request.
For example, if internal audit is planning to audit a new cloud-based system that the organization is implementing in a year, they have time to upskill. The audit could require skills in cloud security, automated controls, and third-party risk that the team has limited experience with today. Identifying those needs in the multi-year plan gives audit leaders time to arrange training, recruit specialists, or secure outside support before the audit begins. The longer view also connects planned work and skill development to the function’s internal audit strategy.
Keeping the forecast alive
The planning horizon should reflect applicable regulatory requirements and the organization’s needs. Where no specific horizon is required, two or three years is often enough to make future coverage and staffing needs visible without treating distant dates as precise. The documented risk assessment should be refreshed at least annually, and the forecast should change when material business events occur. Quarterly reviews can compare the audit schedule with new risks, engagement results, business milestones, and staff availability. Material events may call for an earlier adjustment.
Each time priorities move, the team should ask what work was displaced, whether other assurance remains available, and which important risks now lack planned coverage. The answers should inform the next version of the forecast. Internal Audit technology can help maintain that history and improve planning transparency by using existing audit data and a configured cycle methodology to generate a forecast that auditors can adjust with documented rationale.
A plan that can change with the business
The value of a multi-year audit plan lies in the conversations it makes possible and the preparation those conversations support. Within the audit team, a longer view creates time to prepare for strategic audits, develop new skills, and bring in additional expertise where needed. For the audit committee, the plan makes coverage and tradeoffs more visible to facilitate discussion on why some work comes sooner, what may need to wait, and how today’s resource decisions affect future assurance.
A multi-year plan provides direction while leaving room to adapt. Audit leaders can respond to changing business conditions while keeping future risks, coverage gaps, and capability needs in view. The result is an audit function better prepared for both the work ahead and the changes along the way.
