Factsheet - Work Program Vs Risk and Control Matrix

Factsheet

This is a members only resource.

Please login to access.

Author

IIA-Australia

Date

2025

Topics Explored

Internal Audit, Internal Audit Management 

Format

Factsheet

Extract/Description

The Global Internal Audit Standards require Internal auditors to develop and document an engagement work program that achieve the engagement objectives. In practice internal auditors use a Work Program or a Risk and Control Matrix (RACM).

Key Points

1. There is no requirements to use one or the other – it is just important to document a work program for each internal audit engagement or service to guide the internal auditor to achieve the engagement objectives.

2. While the Global Internal Audit Standards say an engagement work program must be developed and documented, they do not say what it should look like or what it should contain – this Factsheet provides some typical inclusions.

Relevant Industries

All

Level of Assumed Knowledge

Intermediate

Aligned to Global Internal Audit Standards

Yes