How to Build a Risk-Based Audit Plan (Full Walkthrough)

Learn how to build a risk-based audit plan from scratch — from understanding company strategy to presenting a plan the board actually buys into. Ever been asked "why are you auditing this?" and struggled to give a confident answer? In this session, former CAE Linh Truong walks through a complete, practical framework for building a risk-based audit plan that's genuinely aligned with your organization's strategy, not just a rotation through last year's list. Linh covers how to gain visibility into company strategy even without a formal seat at the table, how to layer your own audit risk attributes on top of an enterprise risk assessment to prioritize what actually makes the audit plan, and how to build a realistic timeline from strategy discussions to board approval. She also shares a real example of how to present an audit plan to the board in a way that builds buy-in from the full executive team — not just approval. Whether you're a first-time audit plan owner or a seasoned CAE refining your approach, this walkthrough gives you a repeatable process you can adapt to your organization's size and maturity. 👉 Join the Internal Audit Collective, the community where 1300+ Internal Audit and SOX practitioners connect in real time: internalauditcollective.com Subscribe for more practical, no-fluff internal audit and SOX content. #InternalAudit #RiskBasedAudit #AuditPlanning #CAE #riskmanagement 00:00 Meet Linh Truong & Session Overview 03:38 How to Understand Your Company's Strategy 07:40 From Strategy to Enterprise Risk Assessment 15:45 What Is an Enterprise Risk Assessment? 18:00 Adding Audit Attributes to Prioritize Risks 37:43 Example Audit Plan Timeline 41:50 Presenting the Plan to the Board 50:56 How Much of the Plan Gets Executed? 53:05 Key Takeaways