The annual audit plan is a 12-month bet on which risks will matter. The risk assessment is conducted in April. The audit universe is prioritised. Resources are allocated. The plan is approved by the audit committee. Then the year begins, and the risks change.
A supplier fails in June. A regulatory amendment takes effect in August. A key customer contract is renegotiated in October. A cybersecurity incident occurs in December. A new product launches in February. Each event shifts the risk landscape. The audit plan, frozen in April, does not shift with it.
The auditors arrive at Business Unit C in November to test a risk that was material in April but has been mitigated by a process change in July. Meanwhile, the supply-chain disruption that emerged in June, which has already cost the company Rs 15 crore, was not in the audit plan because it was not in the risk register when the assessment was conducted.
The annual audit plan answered the right question at the wrong time. By the time the assurance arrived, the risk had moved.
Why Static Risk Assessment Fails
The velocity problem
Risk does not wait for the audit cycle. A risk that was “medium” in April can become “critical” by August. A risk that did not exist in April can materialise in September. The annual assessment captures a snapshot. The risk landscape is a moving picture.
The traditional risk-assessment methodology (inherent risk x control effectiveness = residual risk) is structurally incomplete because it omits a variable that matters as much as probability and impact: velocity. How fast can this risk move from emerging to materialised? A compliance risk that evolves over 18 months gives the audit function time to respond. A cyber risk that materialises in minutes does not. Both may have the same residual risk score in a static assessment. They require fundamentally different audit responses.
The information decay problem
The annual risk assessment relies on management interviews, risk workshops and historical data. The information is current on the day it is collected. Within weeks, it begins to decay: conditions change, new information emerges, assumptions are invalidated. By the time the auditor tests the risk (months after the assessment), the information on which the test was designed may be stale.
The resource lock-in problem
The annual plan allocates audit resources for the year. Reallocation requires audit committee approval, disrupts scheduling and creates the perception that the original plan was flawed. The practical result: even when the risk landscape changes materially, the audit plan changes marginally. The function audits what it planned to audit rather than what it should audit.
The Dynamic RBIA Model
In Northrop Management Private Limited’s internal audit advisory practice, the static annual assessment is replaced by a dynamic risk-based internal audit model that continuously updates audit priorities based on changing risk indicators.
The scoring formula
Residual Risk Score = Inherent Risk x Control Exposure x Risk Velocity
Inherent Risk: The risk before considering controls. Scored on impact (financial, operational, reputational, regulatory) and likelihood, using the same methodology as traditional RBIA but updated quarterly rather than annually.
Control Exposure: The inverse of control effectiveness. A control that operates effectively produces low exposure (0.2). A control that exists on paper but does not operate produces high exposure (0.8). A control that does not exist produces maximum exposure (1.0). Control exposure is measured through continuous controls monitoring, not through periodic testing.
Risk Velocity: How quickly the risk can move from emerging to materialised. A slow-moving risk (regulatory change with 18-month implementation) scores low velocity. A fast-moving risk (cyber threat, market disruption, key-person departure) scores high velocity. Velocity determines the audit response time: high-velocity risks require continuous monitoring, not annual testing.
The dynamic risk universe
The static audit universe lists every auditable entity, process and risk. The dynamic risk universe adds: real-time risk indicators (KRIs from operational systems), external data feeds (regulatory changes, industry incidents, market movements), control monitoring data (automated exception reports, control test results) and management risk reporting.
The dynamic universe recalculates residual risk scores continuously. When a score crosses a threshold, the audit priority shifts automatically. The audit plan becomes a living document that responds to the risk landscape rather than predicting it.
The continuous refresh
Instead of annual management interviews, the dynamic model uses four data sources to refresh risk scores:
Operational data: Transaction volumes, error rates, exception counts, customer complaints, employee turnover, system availability, incident reports. Each provides a signal about whether the inherent risk or the control effectiveness has changed.
External data: Regulatory updates, industry incidents, competitor failures, market movements, macroeconomic indicators. Each provides a signal about whether the risk environment has shifted.
Control monitoring data: Automated control test results, exception reports, access reviews, reconciliation results. Each provides a signal about whether controls are operating as designed.
Management risk reporting: Risk register updates, incident reports, near-miss analysis, management self-assessments. Each provides management’s own view of the changing risk landscape.
The four data streams, processed through the scoring formula, produce a continuously updated residual risk score for every item in the audit universe. The audit plan is recalibrated quarterly, with emergency reallocation when scores cross critical thresholds.
The Governance Framework
Dynamic RBIA does not reduce audit committee oversight. It increases it: the committee sees a quarterly risk dashboard showing how scores have changed, which risks have moved into the critical zone, how the audit plan has responded and which planned audits have been deferred because higher-priority risks emerged.
The committee governs the methodology (the scoring formula, the thresholds, the data sources) and approves material reallocations. The chief audit executive operates within the methodology, adjusting priorities as the data directs. The result: the committee governs the framework. The data governs the plan.
Ashish Chaudhary, frames the transformation directly: “The annual audit plan is a bet on which risks will matter 12 months from now. Dynamic RBIA replaces the bet with a system: continuously updated risk scores that redirect audit resources to where the risk actually is, not where the risk was when the plan was written. The audit committee’s role does not diminish. It shifts from approving a static list of engagements to governing a dynamic methodology that produces audit coverage proportional to actual risk.”
Questions for the Boardroom
- Is our internal audit plan based on a risk assessment conducted once per year, or does it incorporate continuously updated risk indicators that shift priorities as conditions change?
- Does our risk-scoring methodology include risk velocity (how fast a risk can materialise), or does it rely solely on probability and impact?
- When a material risk emerged during the year that was not in the original audit plan, how quickly did the audit function respond, and did it require a formal plan amendment?
- Does the audit committee receive a quarterly risk dashboard showing how residual risk scores have changed and how audit priorities have shifted in response?
- What percentage of our audit resources in the last year were deployed against risks that emerged after the annual plan was approved?
Closing Implication
The annual audit plan served the profession well when risks changed slowly, when the audit cycle was the fastest information loop available and when the audit committee had no other source of continuous risk intelligence. None of these conditions holds today. Risks change faster than the audit cycle. Data is available in real time. The audit committee needs continuous risk sensing, not annual assurance. Dynamic RBIA is the methodology that delivers it.