What is an audit universe
The audit universe is every area the function might audit. The annual plan is the shorter list you chose to do this year, and why.
Without a universe, the plan is last year's list copied forward. With one, management or the audit committee can see which areas were rated high and left off the plan.
What each area should hold
- A name a process owner recognises, not an internal code only audit uses.
- The owner of that area.
- A risk rating, and the factors behind it, on the same scale as every other area.
- How often it should be audited, and when it was last audited.
- A flag when it is due and not yet on the plan.
Universe, then plan
The universe is the inventory. The risk-based audit plan is the decision: scope, team, budget, and status for the year. Once that plan is approved, a change belongs in a log. Overwriting the cell hides what was agreed.
A heat map helps only if a cell opens the controls behind it. Colour on its own is a picture, not a plan.
Where teams lose it
The universe sits in one workbook, the plan in another, and the ratings in a third that nobody updates after the workshop. Then the leadership pack is rebuilt by hand. One register, used for both the universe and the plan, is the fix. Excel can stay the place you draft the first list.