Internal Audit

How to Connect ERM to Your Internal Audit Plan

A practical method for turning enterprise risks into audit objectives, scope, timing and explicit exclusions, with a worked ERP-readiness example.

By Eric Kennedy · Tue Oct 27 2026 · 8 min read

To connect ERM to your internal audit plan, translate each important exposure into a question audit can answer. Then decide what evidence would answer it, which processes and locations need testing, and when the conclusion will still be useful. Record what the engagement will leave unresolved.

The output is a plan with a visible connection between a business objective and the work you intend to perform. It should help the audit committee understand both why an engagement belongs on the calendar and what approving it will not cover.

Here is a practical way to build that connection, including a worked example you can adapt.

Bring the business plan, not just the risk register

Start with management's current priorities and commitments: a system rollout, an acquisition integration, a new distribution channel, a refinancing, or a margin improvement plan. Put the relevant enterprise risks beside them. Ask the risk owner what has changed, what response is underway, and which assumption they most need to be true.

This conversation should produce a specific exposure. “Technology risk” is too broad to scope. “The ERP cutover could interrupt order fulfilment during peak season” gives audit a process, a business consequence and a decision window to investigate.

Treat the register as an input to challenge. Read the underlying evidence, compare it with incidents and prior findings, and ask whether important risks are missing. If the assessment is stale, use operating information and discussions with leadership to fill the gaps. Do not postpone useful planning until the company has a perfect ERM process.

The IIA's Global Internal Audit Standards, Standard 9.4 requires a documented, at-least-annual assessment of strategy, objectives and risks, informed by board and senior management input. The plan must remain responsive to change. The CAE must communicate resource constraints and reasons for omitting high-risk assurance work; the board approves the plan and significant changes.

Those are requirements. The mapping method below is KRG's practical recommendation, not a prescribed IIA template.

Decide whether an audit would help

A high enterprise risk does not automatically justify a new engagement. First identify the uncertainty that independent examination could reduce.

For an ERP rollout, that might be whether the readiness report is supported by realistic testing. For a new sales channel, it might be whether pricing exceptions are visible before commitments are made. The audit question should identify something that can be examined, not merely repeat the risk's name.

Then ask what leadership could do differently with the answer. Could it change timing, scope, funding or a control? If the report would arrive after the decision, move the work earlier or reconsider the engagement.

There is an honest counterpoint: sometimes management already knows the problem and needs to act. Another audit documenting an acknowledged staffing shortage may add less value than following up on the response or examining a different uncertainty. Explain that judgment instead of scheduling work solely because the risk is highly ranked.

Also check existing assurance. Standard 9.5 requires coordination and consideration of reliance on other providers. Reliance needs a documented basis; responsibility for internal audit's conclusions remains with the CAE. Our assurance-mapping guide addresses how to evaluate the work already available. Here, the next decision is what future audit work to commission.

Build the engagement around an answerable question

Consider this illustrative scenario, constructed for this article rather than drawn from a KRG client engagement.

A distributor plans an ERP rollout before warehouse peak season. The business objective is to keep customer orders moving. The enterprise risk is that the cutover disrupts order fulfilment. Management's readiness report says the rollout is on track, but the CAE wants to understand what supports that conclusion.

The proposed audit question is: Does readiness evidence support continuity?

That is narrower than “Is the ERP implementation successful?” It points to evidence the audit team can examine before management makes the go/no-go decision.

The distinction is important when staffing the work. This engagement needs people who can evaluate the order process and its system dependencies. A team experienced only in access-control testing may need specialist support. Naming the ERP in the audit plan does not establish that the team can examine the operational question.

Standards 13.2 and 13.3 address engagement risk assessment and documented objectives and scope. Scope must be sufficient for the objectives; unresolved scope limitations are escalated under the applicable methodology. Use that discipline to make the proposed work precise.

Illustrative audit-plan entry

This is a plan entry, not the completed audit program. During engagement planning, the team still needs evaluation criteria, testing procedures and an appropriate approach to selecting evidence.

For example, do not accept “testing passed” without examining what passed. Did the end-to-end exercise include the order types and interfaces the warehouse will use? Were inventory differences resolved or simply moved to an exception list? Did the rollback rehearsal demonstrate the proposed sequence, or was it only a discussion?

These questions do not prescribe an ERP implementation method. They help the team examine whether a particular management conclusion is supported.

Separate the audit conclusion from the management decision

In this illustrative scenario, audit tests end-to-end test evidence, inventory reconciliation, rollback rehearsal and unresolved critical defects.

Management decides whether to proceed, delay or phase the rollout; whether to accept remaining exposure; how to fund fixes and support; and how to own customer commitments.

State exclusions. Do not imply full ERP assurance. A conclusion about readiness evidence for one warehouse does not establish that every rollout wave is ready, that cybersecurity is effective, or that the investment will achieve its return. It also cannot guarantee that production will behave exactly like a test environment.

The report can inform a go/no-go decision without making it. If audit starts selecting fixes or owning the rollout, the role changes. Where the CAE or audit team also performs ERM responsibilities, review the safeguards described in internal audit's role in ERM before assigning assurance work.

Make the choices visible across the whole plan

Repeat the mapping for the other proposed engagements, then compare them together. One audit may address parts of several enterprise risks. One enterprise risk may require several engagements, management monitoring and specialist work. Avoid forcing a one-risk-to-one-audit relationship.

Keep a short record of important exposures without planned audit work. State why: suitable assurance is available elsewhere, another engagement has greater priority, the evidence is not yet ready, or the required skills and hours are unavailable. These explanations are different and should not all become a green “covered” label.

Where capacity is the constraint, show the choice that additional resources would enable. A specialist could make a readiness review feasible; adding generalist hours might not. The ERM sizing guide can help distinguish central risk-program workload from distributed support, but those hours are not automatically available to deliver the audit plan.

In the plan discussion, make the tradeoff concrete. Which proposed engagement would move if the ERP work were brought forward? What would remain unexamined? Does leadership understand the consequence? A transparent omission is more useful than a broad engagement title that suggests coverage nobody has scoped.

Revisit the connection when the facts change

Use the decision calendar as well as the reporting calendar. For the illustrative ERP engagement, relevant changes include a failed rehearsal, a new rollout location, an unresolved defect affecting order flow, or a postponed go/no-go date.

A delay does not always mean audit should move earlier. If the necessary tests have not happened, there may be little evidence to examine. The immediate action may be to communicate that limitation and reconsider the engagement's timing. If a serious problem is already established, management may need to address it before further audit work adds value.

After the engagement, feed the conclusion and its limits back into ERM. A completed audit should not automatically reduce the risk rating. Management needs to consider what the findings establish, which responses remain incomplete and whether the exposure has actually changed.

For your next planning discussion, bring one proposed engagement with its linked objective, audit question, scope, timing and exclusions. Ask the risk owner and audit committee whether that work would answer the question they think they are commissioning.

If the risk report itself does not make the exposure and decision clear, start there. KRG's Board-Reporting Scorecard is a short check on the reporting foundation, not an audit-plan assessment or a substitute for the CAE's judgment.

Take the Board-Reporting Scorecard