Which approach should a chief audit executive take when preparing the internal audit plan?

The internal audit plan should be risk-based. To achieve this, the CAE should develop an audit

universe that lists all auditable units (processes, functions, systems, etc.) and use it as the foundation

for risk assessment and prioritization.

Option B is too narrow (monetary value is just one factor). Option C is incomplete since senior

management’s input is important but not the sole basis. Option D is incorrect because eliminating

units not mandated by law ignores risk-based planning requirements.

Thus, the most appropriate approach is Option A: establishing an audit universe.

Reference:

IIA Standards – Standard 2010: Planning; IIA Practice Guide – Developing a Risk-based Internal Audit

Plan.