IA-04
Risk-Based Annual Audit Planning Kit
Build a risk-based annual audit plan ready for Audit Committee approval.
IA-03
Permanent File Kit
A ready structure for the client's permanent file and the register of laws and regulations that apply to it.
Inside the kit
What this kit solves
Every engagement goes back to the same facts about the company: its activity, structure, authorities and applicable regulations. This kit puts the permanent file into one structure: company background (201), governance documents (202), approved policies and procedures (203) as the benchmark for actual practice, the register of applicable laws and regulations (204) and prior internal audit reports (206). Slots hold the client's own documents, such as the commercial registration, DOA matrix, approved charter and financial statements (205). Each template includes a filled example. The templates include a note on the reporting-line wording in local bank charters (SAMA) and another on audit committees in associations (NCNP).
What your file holds afterwards
- A permanent file that opens with company background (201) and slots for its legal documents, organisation chart and DOA (20101–20103)
- Governance documents (202) with slots for the audit committee charter, minutes and approved internal audit charter (20201–20203)
- A reference copy of approved policies and procedures (203) to test actual practice against
- A register of applicable laws and regulations (204) by the company's activity, such as CMA, SAMA, NCA ECC and PDPL requirements
- Prior internal audit reports (206) with the status of their findings
How to use it
- Complete company background in 201 and file the supporting documents in 20101 to 20103.
- Collect governance documents in 202 with the charter, minutes and approved IA charter (20201–20203).
- Record approved policies in 203 and applicable regulations in 204.
- Add the financial statements and external auditor's report in 205 and prior reports in 206.
Who it is for
Audit firms and in-house internal audit departments setting up a company's file for the first time, then referring to it on every later engagement.
What is in the kit
| Code | Paper | Format | What you get | Reference |
|---|---|---|---|---|
| 201 | Company Background InformationReference: 9.1 | Word | Template + worked exampleTemplate + example | 9.1 |
| 20101 | Commercial Registration and Articles / BylawsReference: 9.1 | — | Slot for a client documentClient document | 9.1 |
| 20102 | Approved Organisation ChartReference: 9.1 | — | Slot for a client documentClient document | 9.1 |
| 20103 | Approved Delegation of Authority Matrix (DOA)Reference: 9.1 | — | Slot for a client documentClient document | 9.1 |
| 202 | Governance DocumentsReference: 9.1 | Word | Template + worked exampleTemplate + example | 9.1 |
| 20201 | Governance Regulation and Audit Committee CharterReference: 9.1, 8.1 | — | Slot for a client documentClient document | 9.1, 8.1 |
| 20202 | Relevant Audit Committee MinutesReference: 8.1 | — | Slot for a client documentClient document | 8.1 |
| 20203 | Approved Internal Audit CharterReference: 6.2 | — | Slot for a client documentClient document | 6.2 |
| 203 | Approved Policies and ProceduresReference: 13.4 | Word | Template + worked exampleTemplate + example | 13.4 |
| 204 | Register of Applicable Laws and RegulationsReference: 9.1 | Excel | Template + worked exampleTemplate + example | 9.1 |
| 205 | Financial Statements, External Auditor's Report and Management LetterReference: 9.1 | — | Slot for a client documentClient document | 9.1 |
| 206 | Prior Internal Audit ReportsReference: 9.1 | Word | Template + worked exampleTemplate + example | 9.1 |
Every kit also includes a user guide (PDF and PowerPoint) and the licence terms, in Arabic and English.
IIA Global Internal Audit Standards (2024) references, with ISQM 1 and SAMA principles where they apply, as given in the guide. References are for cross-referencing and do not imply IIA endorsement.
Where it sits in the audit cycle
- 000File AdministrationIA-01
- 100Acceptance, Engagement and AdministrationIA-02
- 200Permanent and Annual FileIA-03IA-04
- 300Engagement PlanningIA-05IA-08
- 400Process Understanding and Control AssessmentIA-06IA-08
- 500Testing and FieldworkIA-07IA-08
- 600FindingsIA-09
- 700Reporting and Follow-upIA-09IA-10
- 800Advisory EngagementsReplaces 400–700 on advisory engagementsIA-11
- 900Quality Review and File ClosureIA-12
Sector notes inside the templates
- Local banks — Saudi Central Bank (SAMA)
Functional reporting to the Audit Committee and administrative reporting to the CEO (Internal Audit Principles for Local Banks (effective 1 January 2022)) - Associations and civil foundations — National Center for Non-Profit Sector Development
Associations with annual revenue of SAR 5 million or more form an internal audit committee (Governance Rules for Associations and Civil Foundations (Umm Al-Qura, 2023) — Article 20)
The affected templates carry a short line for each requirement with its reference. Check the official text of each reference before relying on it; regulations change.