How to build a risk-based internal audit plan
The plan is a decision about where audit time goes. It should come from rated areas, not from last year's list copied forward.
Start with the audit universe: each auditable area, its owner, its risk rating, the factors behind that rating, and how often it should be audited. Areas that are due and not yet on the plan should be visible, not buried in a comment.
From universe to annual plan
The annual plan then records scope, team, budget and status. Once leadership has approved it, changes belong in a log, not in a cell that overwrites last quarter's decision.
Scores for likelihood and impact, before and after the control, should use the same scale in every register. A heat map is useful only if a cell opens the controls behind it.
What the board actually needs
Not a new methodology. They need to see which areas were chosen, which were deferred, and whether the plan still matches the ratings. That is the same information the leadership pack should print later in the year.