IA-03
Permanent File Kit
A ready structure for the client's permanent file and the register of laws and regulations that apply to it.
IA-04
Risk-Based Annual Audit Planning Kit
Build a risk-based annual audit plan ready for Audit Committee approval.
Inside the kit
What this kit solves
An annual plan without a documented risk assessment is hard to defend before the Audit Committee. This kit starts with the audit universe (20701), then rates and ranks each unit by likelihood and impact in the matrix (20702), within the entity-level risk assessment (207). The annual plan (208) follows from that assessment, with each engagement's number and timing. Paper 20802 allocates hours by engagement and team member, and paper 209 documents coordination with the external auditor and other assurance providers. Slot 20801 holds the signed plan or approval minutes. Each template includes a filled example. The templates include a note on SAMA expectations for the annual plan in local banks.
What your file holds afterwards
- A complete audit universe (20701)
- A risk assessment matrix ranking units by likelihood and impact (20702), within the entity-level assessment (207)
- A risk-based annual plan (208) ready to present to the Audit Committee, with a slot for the signed copy (20801)
- Annual resource and hours allocation by engagement and team member (20802)
- Documented coordination with the external auditor and other assurance providers (209)
How to use it
- Define the audit universe in 20701.
- Rate the risks in 20702 and summarise the result in 207.
- Build the plan in 208, allocate hours in 20802 and coordinate with other assurance providers in 209.
- Present the plan to the Audit Committee and file the signed copy in 20801.
Who it is for
Audit firms and in-house internal audit departments preparing or updating the annual plan before it goes to the Audit Committee.
What is in the kit
| Code | Paper | Format | What you get | Reference |
|---|---|---|---|---|
| 207 | Entity-Level Risk AssessmentReference: 9.2, 9.4 | Excel | Template + worked exampleTemplate + example | 9.2, 9.4 |
| 20701 | Audit UniverseReference: 9.4 | Excel | Template + worked exampleTemplate + example | 9.4 |
| 20702 | Risk Assessment MatrixReference: 9.4 | Excel | Template + worked exampleTemplate + example | 9.4 |
| 208 | Risk-Based Annual Audit PlanReference: 9.4 | Excel | Template + worked exampleTemplate + example | 9.4 |
| 20801 | Audit Committee Approved PlanReference: 9.4, 8.1 | — | Slot for a signed copy of another templateSigned copy | 9.4, 8.1 |
| 20802 | Annual Resource and Hours AllocationReference: 8.2, 10.2 | Excel | Template + worked exampleTemplate + example | 8.2, 10.2 |
| 209 | Coordination with External Auditor and Other Assurance ProvidersReference: 9.5 | Word | Template + worked exampleTemplate + example | 9.5 |
Every kit also includes a user guide (PDF and PowerPoint) and the licence terms, in Arabic and English.
IIA Global Internal Audit Standards (2024) references, with ISQM 1 and SAMA principles where they apply, as given in the guide. References are for cross-referencing and do not imply IIA endorsement.
Where it sits in the audit cycle
- 000File AdministrationIA-01
- 100Acceptance, Engagement and AdministrationIA-02
- 200Permanent and Annual FileIA-03IA-04
- 300Engagement PlanningIA-05IA-08
- 400Process Understanding and Control AssessmentIA-06IA-08
- 500Testing and FieldworkIA-07IA-08
- 600FindingsIA-09
- 700Reporting and Follow-upIA-09IA-10
- 800Advisory EngagementsReplaces 400–700 on advisory engagementsIA-11
- 900Quality Review and File ClosureIA-12
Sector notes inside the templates
- Local banks — Saudi Central Bank (SAMA)
Risk-based annual plan with a documented assessment, approved by the Audit Committee and updated at least annually (Internal Audit Principles for Local Banks (effective 1 January 2022))
The affected templates carry a short line for each requirement with its reference. Check the official text of each reference before relying on it; regulations change.
Related kits
IA-05
Engagement Planning Kit
Plan each engagement: scope, risks, fraud, time budget and the document request list.
IA-10
Follow-up and Audit Committee Reporting Kit
Track recommendations to closure and give the Audit Committee periodic reports and KPIs.