The Advantages and Disadvantages of Using an Audit Universe to Manage Business Risk Assessments and Create Audit Plans.

As internal auditors, our mission is to provide independent and objective assurance and consulting services designed to add value and improve an organisation's operations. A cornerstone of achieving this is effectively identifying and assessing risks and then planning our audit activities accordingly. One tool often discussed in this context is the Audit Universe.

So, what exactly is an Audit Universe? Simply put, it's a comprehensive inventory of all the auditable areas within an organisation. This can include departments, processes, systems, projects, and even strategic objectives. Think of it as a map of everything internal audit could potentially look at.

Let's delve into the pros and cons of using this tool:

Advantages of Using an Audit Universe:

• Comprehensive Coverage: The primary benefit of an Audit Universe is that it ensures all areas of the organisation are considered for potential audit activity. This reduces the risk of overlooking significant areas or emerging risks. As Standard 2010 of the International Professional Practices Framework (IPPF) states, "The chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organisation's goals." An Audit Universe provides the foundation for this risk-based planning.   

• Structured Risk Assessment: With a defined universe, risk assessment becomes more systematic. Each auditable entity can be evaluated based on its inherent risks, controls, and strategic importance. This allows for a more objective and consistent approach to prioritising audit efforts.

• Improved Audit Planning: The Audit Universe serves as a roadmap for developing the annual audit plan. By understanding the universe and the associated risks, internal audit can allocate resources effectively to the areas of highest risk and strategic importance. Standard 2020 emphasizes the need for resource management, stating, "The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan."   

• Enhanced Stakeholder Communication: Having a documented Audit Universe can facilitate discussions with management and the audit committee about audit coverage and priorities. It provides transparency regarding what areas are within the scope of internal audit and how audit plans are developed.

• Long-Term Perspective: The Audit Universe encourages a longer-term view of audit coverage. It helps ensure that over time, all significant areas of the organisation receive appropriate audit attention.

• Identification of Interdependencies: Mapping the organisation into an Audit Universe can help identify interdependencies between different departments and processes, highlighting potential systemic risks that might otherwise be missed.

Disadvantages of Using an Audit Universe:

• Can Become Bureaucratic and Static: If not maintained and updated regularly, the Audit Universe can become a static document that doesn't reflect the dynamic nature of the organisation and its evolving risks. This can lead to the audit plan being based on outdated information.

• Resource Intensive to Develop and Maintain: Creating a comprehensive Audit Universe and keeping it current requires significant time and effort. This can be a challenge, especially for smaller internal audit functions.

• Potential for Over-Emphasis on Low-Risk Areas: If the risk assessment process isn't robust, the Audit Universe might lead to audit resources being allocated to low-risk areas simply because they are included in the universe. The focus should always be on materiality and risk.

• May Not Capture Emerging or Ad-Hoc Risks Effectively: A static Audit Universe might not readily accommodate emerging risks or urgent, ad-hoc requests for audit work that fall outside the predefined auditable entities. Flexibility is crucial.

• Risk of a "Tick-Box" Approach: There's a danger that internal audit might feel compelled to audit every entity in the universe over a certain period, even if the risk profile doesn't warrant it. This can lead to a less risk-focused approach.

Conclusion: Should an Audit Universe Be Used?

On balance, while there are disadvantages to consider, an Audit Universe is a valuable tool for managing business risk assessments and creating audit plans, provided it is implemented and maintained effectively. The advantages of comprehensive coverage, structured risk assessment, and improved planning significantly outweigh the potential drawbacks.

However, the key is to avoid the pitfalls. The Audit Universe should be a living document, regularly reviewed and updated to reflect changes in the organisation's structure, strategy, and risk landscape. The risk assessment process applied to the universe must be robust and dynamic, ensuring that audit efforts are truly focused on the areas that matter most. It should not become a bureaucratic exercise but rather a practical tool that supports a risk-based and value-adding internal audit function.