Brink's Modern Internal Auditing

CHAPTER 13 Areas to Audit: Establishing an Audit Universe and Audit Programs

With overall objectives to review and improve internal controls as well as to promote the effectiveness and efficiency of operations, an internal audit function is presented with a wide variety of areas and activities to include in its internal audit reviews. It can concentrate on reviews of financial process internal controls, all worldwide operational areas in the enterprise, safety and security issues, information technology (IT) systems–related controls, or any of a series of other areas. Given the broad scope of enterprise operations, management, and audit committees demand for internal audit attest services, most internal audit functions find that there are just too many areas to include within internal audit’s planning and performance scope given staff skill, budget, and timing constraints. Internal audit functions need to establish their own basis point or foundation to define the areas within their scope that they may consider for internal audits. This list of potential areas to audit is often called the audit universe.

Although the term universe sounds a little space age, the term and concept have been used by internal auditors for some time. With reviews and approvals by the audit committee and senior management, the audit universe is the established population of auditable entities for any internal audit function. Such an audit universe may not cover every unit in the enterprise, as some ...