IMPROVING THE METHODOLOGY OF RISK-BASED INTERNAL AUDIT PLANNING IN COMMERCIAL BANKS

Abstract

This article proposes a risk-based methodology for developing annual internal audit plans in
commercial banks. The methodology comprises a six-stage algorithm: establishing the audit universe, assessing
audit objects according to eight risk factors, calculating an integrated risk score, determining risk categories
and audit frequency, preparing an audit-hours budget and an annual audit plan, and conducting dynamic risk
monitoring. The scoring framework incorporates financial scale, credit risk, operational risk, compliance and
legal risk, information technology dependence and cyber risk, the intensity of change, audit and control history,
and the time elapsed since the previous audit. Each factor is supported by predefined assessment criteria and
justified weighting coefficients, while the calculation procedure is illustrated using a hypothetical example. The
distinctive elements of the methodology include a trigger-monitoring framework for revising the annual audit
plan, an automatic escalation mechanism based on the time elapsed since the previous audit, a mandatorycoverage
list, and a simplified version adapted to smaller internal audit functions.