A function whose three-year strategy names "increase audit coverage" as its goal has no strategy. Coverage is an output. Strategy names what stakeholders need from internal audit and how the function will build the capability to deliver it.
An internal audit strategy is a multi-year plan (commonly three to five years) describing where the function is going, what capabilities it must build, and how it will resource them. It is not the annual audit plan. The annual plan schedules engagements for one cycle. The strategy decides what kind of function will execute those cycles.
The chain runs in one direction. The organization sets its business strategy and objectives. Those objectives create risks to achieving them. Management's risk management practices respond to those risks. Internal audit's strategy positions the function to provide assurance and advice over the risks that matter most to those objectives.
KEY: Internal audit strategy is derived from the organization's strategy, never independent of it. If a stem describes a function whose strategy was built solely from internal preferences (staff interests, prior-year hours...
Common mistakes
- Writing strategy from the inside out. Building the multi-year plan from staff skills and prior-year hours instead of organizational objectives, risks, and stakeholder input inverts the cascade.
- Confusing the strategy with the annual audit plan. The strategy is the multi-year capability and positioning document. The annual plan is one cycle of engagements derived from it.
- Swapping mission and vision. Mission is present purpose and whom you serve. Vision is the future state. A stem asking which statement describes what the function aspires to become wants vision.
Bottom line
- Strategy direction: organizational objectives create risks, risks plus stakeholder expectations shape internal audit strategy; the flow never runs backward.
- Strategy versus plan: the strategy is a multi-year capability and positioning document; the annual audit plan is one cycle derived from it.
- Mission: present purpose, whom the function serves, and the value delivered; it anchors daily decisions.
- Vision: the aspirational future state over the strategy horizon; it drives capability initiatives and performance measures. Both must fit the charter and the organization's own mission and values.
Exam shortcut
Read the stem for direction of derivation. If internal audit's strategy was built from staff preferences, prior-year hours, or auditor convenience, the answer names failure to align with organizational objectives and stakeholder expectations. For mission-versus-vision items, scan the verb tense. Present tense purpose statements are mission. Future-state or "aspires to" language is vision. For resource questions, compute available hours before answering: headcount × gross hours × (1 − non-audit percentage).
The full lesson (about 2,450 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 3
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.