Before you sign off your 2027 internal audit plan

A useful 2027 internal audit plan connects business objectives, significant risks and change with the questions the organisation needs answered. Before agreeing it, challenge the coverage, the timing of the work and the skills needed to deliver it.

BTL's paper, Before You Sign Off Your 2027 Internal Audit Plan, brings together 12 points for consideration, with questions, evidence to look for and illustrative audit titles and scopes. Use them beside your draft plan and your organisation's own planning methodology.

The aim is to spot a gap, question an assumption or make work already planned more useful. You may also decide that your existing coverage is sound.

Three things to check before approval

Coverage: Would the planned work answer the important question? A review of AI policies might never establish whether people challenge AI output. A supplier review might miss the dependency shared by several critical services.

Timing: Will the answer arrive while management can still act? A review after a launch or reporting deadline may identify an important problem too late to influence that decision.

Capacity: Have you allowed for data preparation, supervision, specialist skills and investigating exceptions? Moving work from one quarter to another changes its timing. It does not create additional annual capacity.

What does the planning paper cover?

The 12 themes help you look across emerging issues and established controls:

1. AI and human judgement: who sets the purpose and limits, and what must a reviewer check and decide?
2. Shadow AI and data: where is AI actually used, including personal tools and features inside existing software?
3. AI economics: does the business case still work after human review, corrections, support and other costs?
4. Full-population testing: where could wider or repeated tests provide better evidence, and what would they still miss?
5. Cyber and impersonation: could a convincing fake instruction release money, data or access?
6. Services and suppliers: could the business keep a critical service running through failure, including shared dependencies?
7. Control cost and assurance coverage: is effort proportionate to the risk, or are repeated checks hiding important gaps?
8. Material controls: does the evidence support the conclusion, with ownership clear across teams?
9. Culture and behaviour: what happens to controls when pressure rises or someone raises a concern?
10. People and business change: do skills, capacity, duties and controls support the work the business needs to deliver?
11. Data and privacy: is source data fit for use, and are personal-data flows understood and controlled?
12. Regulatory change: which changes apply, who owns readiness and when would assurance be useful?

Relevance depends on your organisation. Confirm applicable requirements and dates with the appropriate specialists. The paper is BTL's perspective, not an exhaustive risk list or confirmation of compliance.

Use one point to improve one planned audit

Work through this with your draft plan open:

Pick one relevant point in the paper. Choose something that matters to your organisation, such as how people review AI output.

Find the audit that should cover it. Read the planned scope. Would the work answer the question raised in the paper? If no planned audit covers it, record the gap for your planning discussion.

Decide what needs to change. You might add a test, bring the review forward or get specialist help. If coverage is already sound, keep it.

For example: your AI governance audit might check policies but never test whether people challenge AI output. Add a walkthrough of one real AI-assisted decision and inspect the review evidence. Who reviewed it, what did they check and could they reject or override the output?

Write down the change, why it matters, the evidence you need and any extra time or skills. Take changes through your normal approval route.

Questions about 2027 internal audit planning

What should a 2027 internal audit plan cover?

Bring together business objectives, significant risks and change, the questions leaders need answered, and audits required by applicable laws or regulations. Confirm required coverage and deadlines with compliance or legal colleagues. Consider existing assurance, previous findings, resources and any important gaps.

Does every point need a separate audit?

No. You might adjust an existing review, run a focused test or use advisory work, project assurance or training. These options do not replace audits you are required to undertake. Protect required coverage, agree appropriate safeguards and keep management responsible for its decisions.

Does the paper replace our planning methodology?

No. Use it alongside your methodology, risk assessment and applicable obligations. It provides questions to challenge the plan, rather than an exhaustive risk list or confirmation that coverage is complete. The IIA's risk-based planning guide provides supporting guidance.

How do I know whether my team has the skills?

For each review, list the skills needed, who has them and who can supervise the work. Check recent experience and work quality, alongside qualifications. Identify gaps early and choose training, supervised practice or specialist support. Allow for the time those options need.

Who should I speak to before seeking approval?

Speak with business leaders and the people closest to the risks, including finance, risk, compliance, controls and IT. Compare coverage with other assurance providers. Discuss priorities and resource gaps with senior management and the audit committee chair. The audit committee typically approves the plan, under the authority delegated to it by the board.

Keep those conversations going after approval. Review the plan when risks, business priorities or regulatory requirements change. Explain any work you add, defer or remove, and the effect on coverage and resources. Agree what counts as a significant change and take those changes back to the audit committee for approval.

Further reading: The IIA's Global Internal Audit Standards, particularly Standards 9.4 and 9.5, cover stakeholder input, plan updates and coordination with other assurance providers.

How do I ask for more budget?

Show what the extra money enables: the review, skills or earlier answer needed, its cost and the coverage gap it closes. Compare options, such as reprioritising work, training or specialist support. Present a recommendation and the consequences of staying within the existing budget. Make coverage limitations clear to senior management and the board.

How do I start auditing AI if it is new to me?

Find out where AI is used, who owns it and which decisions it affects. Choose one clearly defined business use. Start with governance, data handling, approvals and human review, supported by The IIA's AI Auditing Framework. Bring in specialist skills where needed. A governance review does not establish that a model is technically reliable.

Take the paper into your next planning discussion

The free 17-page paper expands these themes with questions, evidence and illustrative scopes you can adapt. Read it alongside your draft, choose a useful point and discuss what should change, if anything.

You will also receive BTL's practical email newsletter every two weeks and can unsubscribe at any time.