Audit hours are a scarce resource. A mid-market company’s internal audit function may have 3,000 to 5,000 person-hours per year. The question is not how to fill those hours. It is how to allocate them where the expected value of assurance is highest.
The traditional allocation is rotational: each auditable area receives its scheduled audit every two to three years, with hours distributed roughly equally across areas regardless of their risk significance. A procurement audit receives 300 hours. A payroll audit receives 250 hours. A fixed-asset audit receives 200 hours. The allocation reflects the rotation, not the risk.
The Risk-Based Internal Audit Matrix replaces the rotation with a prioritisation framework that allocates audit hours in proportion to the expected loss each area could produce if its controls failed.
Building the Matrix
Step 1: Define the audit universe
List every auditable area, process, function and risk category across the enterprise. The universe should include traditional process areas (procurement, payroll, revenue cycle, inventory, cash management, fixed assets, compliance) and enterprise-risk areas (customer concentration, key-person dependency, technology resilience, regulatory compliance, fraud vulnerability, related-party transactions, working-capital management, data security).
A comprehensive audit universe for a mid-market company typically contains 30 to 50 areas.
Step 2: Score each area on three dimensions
Risk significance: What is the maximum financial, operational or reputational impact if controls in this area fail? Score on a 1-to-5 scale, where 1 = impact below Rs 10 lakh, 5 = impact above Rs 50 crore or existential risk.
Control maturity: How mature and reliable are the existing controls? Score inversely: 1 = strong automated controls with continuous monitoring, 5 = weak or non-existent controls with manual dependencies and no monitoring. The lower the control maturity, the higher the residual risk and therefore the higher the audit priority.
Velocity of change: How much has this area changed since the last audit? New systems, new processes, new regulations, new personnel, organisational restructuring or rapid growth all increase the probability that existing controls are no longer adequate. Score 1 = stable, 5 = material change since last review.
Step 3: Calculate the composite risk score
Composite score = Risk significance x Control maturity x Velocity of change
The maximum score is 125 (5 x 5 x 5). The minimum is 1 (1 x 1 x 1).
Step 4: Rank and allocate
Rank all areas by composite score. Allocate audit hours in proportion to the score: the highest-scoring areas receive the most hours. The lowest-scoring areas receive minimal hours or are deferred to the following year.
The result: audit hours concentrate where the combination of high impact, weak controls and recent change creates the greatest residual risk. Areas with strong controls, low impact and no recent change receive minimal attention, freeing hours for areas where the expected value of assurance is highest.
Why the Matrix Changes Audit Outcomes
High-impact areas receive proportional attention
A customer-concentration risk with a composite score of 100 (significance 5, control maturity 4, velocity 5) receives five times the audit hours of a petty-cash process with a composite score of 20 (significance 2, control maturity 2, velocity 5). The traditional audit would give both similar coverage. The matrix ensures that the risk that could destroy 40% of revenue receives proportionally more scrutiny than the risk that could lose Rs 50,000.
Control maturity drives audit intensity
An area with immature controls (manual, person-dependent, unmonitored) receives more audit attention than an area with mature controls (automated, systematically enforced, continuously monitored), even if the risk significance is similar. The logic: mature controls are less likely to fail and more likely to self-detect when they do. Immature controls are more likely to fail silently.
Change triggers re-evaluation
An area that was stable last year but underwent significant change (new system, new regulation, new personnel, rapid growth) receives increased audit attention regardless of its historical risk score. Change invalidates the assumptions on which prior control assessments were based.
The Annual Audit Plan
The Risk-Based Internal Audit Matrix produces an annual audit plan that looks materially different from a rotational plan.
A rotational plan might allocate: procurement 300 hours, payroll 250 hours, inventory 200 hours, fixed assets 200 hours, cash 150 hours, compliance 200 hours, other 200 hours. Total: 1,500 hours distributed roughly equally.
A risk-based plan for the same company might allocate: customer concentration and revenue quality 400 hours, related-party transactions and counterparty independence 300 hours, working capital and cash management 250 hours, technology and data security 200 hours, regulatory compliance 200 hours, procurement 100 hours, payroll 50 hours. Total: 1,500 hours concentrated on the highest-risk areas.
The second plan covers fewer areas with more depth on the areas that matter most. The first plan covers all areas with insufficient depth on any.
In Northrop Management Private Limited’s assurance advisory work, we build Risk-Based Internal Audit Matrices as the foundation for every audit plan redesign. The matrix is refreshed annually (as risk profiles change) and produces a plan that the audit committee can evaluate against the enterprise-risk register for alignment.
Ashish Chaudhary, frames the allocation principle directly: “An audit plan is a capital-allocation decision for assurance resources. Every hour spent auditing a low-risk area is an hour not spent auditing a high-risk area. The matrix makes this trade-off explicit, so the audit committee can see where the assurance is concentrated and, critically, where it is absent.”
Questions for the Boardroom
- Is our audit plan built from a risk-scoring matrix, or from a rotational schedule?
- What percentage of total audit hours are allocated to the company’s three most significant enterprise risks?
- Does the audit plan explicitly deprioritise low-risk areas to free hours for high-risk ones, or does it attempt to cover everything equally?
- When was the risk scoring last refreshed, and does it reflect current conditions (including recent organisational changes, new regulations and competitive dynamics)?
- If the audit committee compared the audit plan to the enterprise-risk register, would they find alignment or divergence?
Closing Implication
Audit resources should follow expected loss, not organisational habit. An audit plan that allocates 300 hours to a procurement process with strong controls and limited financial exposure, while allocating zero hours to a customer-concentration risk that could eliminate 40% of revenue, has not made a risk-based allocation. It has made a rotational allocation that happens to consume audit hours without providing assurance on the risks the board should be most concerned about.
The Risk-Based Internal Audit Matrix converts this allocation from an inherited habit into a deliberate, scored, defensible decision. The areas that receive audit attention are the areas where the combination of impact, control weakness and change velocity creates the greatest residual risk. Everything else is deprioritised, not because it is unimportant, but because the areas that are prioritised are more important.
