A common finding in IT examinations sounds something like this: the scope and cycle of an institution’s IT audits should be more closely tied to risk. A lot of institutions run IT audits on a fixed 12-month schedule and aren’t sure what more they should be doing to satisfy that finding.

Running IT audits every 12 months already reflects a real, correct judgment: that IT is a major source of risk for the organization. The examiner isn’t second-guessing that decision. What they’re asking for is documentation of how the institution arrived at it. Why 12 months, and not 6, or 18, or 24? The FFIEC Audit Handbook is specific about what risk assessment guidelines need to spell out: a maximum length for audit cycles based on risk scores. Some institutions set 12 months or less for high-risk areas, 24 months or less for medium-risk areas, and up to 36 months for low-risk areas, with audit cycles that are never left open-ended.

“That’s how we’ve always done it” used to be an acceptable answer. It isn’t anymore. Examiners increasingly want a clearer basis for both the scope and frequency of IT audits, and the Audit Handbook is direct about what a risk-based IT audit program should include: a measurement or scoring system that ranks and evaluates business and control risks across an institution’s significant business units, departments, and products.

That points to a pattern worth naming: the de facto scoring system. It shows up any time someone at an institution makes an undocumented risk-based decision, and it happens more often than most people realize. A common example is deciding certain vendors don’t need to be included in a vendor management program because they seem to fall below some minimum risk threshold. The stronger approach is to risk-assess and score every vendor, then apply controls, or not, based on that inherent risk score.

A fixed 12-month audit cycle is the same pattern in a different form. Someone at the institution made an undocumented call that IT risks and controls should be reviewed annually. The examiner isn’t faulting that decision either. What’s missing is the process behind it.

Building a robust IT or vendor risk scoring system isn’t easy, but it’s a real regulatory expectation, and it’s exactly where this kind of finding is pointing. A comprehensive risk management system evaluates the source of risk (usually an institution’s business processes and the assets those processes depend on), the risks and threats to those sources, and the controls in place for whatever’s been identified, applying a numeric score at each step. That’s a simplified version of the process. An FDIC Financial Institution Letter on risk modeling is a useful reference for anyone who wants to go deeper.

Done well, this process produces a ranked list: risk sources from high to low, risks and threats from high to low, controls from strongest to weakest. The key detail is scoring risk twice, once at the inherent level, before controls, and again at the residual level, after controls. An institution’s audit plan should then specify that IT audits are risk-based, with scope focused on inherent, not residual, risk levels for the riskiest assets, the highest risks and threats, and the most critical controls, and an audit cycle of 12 months or less for those high-risk areas.

This approach does more than satisfy the examiner. Handing it to the IT auditor ahead of the engagement also makes their job easier, giving them exactly what they need to build the scope of work.

A Quick Reference: Audit Program vs. Audit Plan

Two terms are worth keeping straight, both defined in the FFIEC IT Examination Handbook’s Audit booklet:

• Audit Program: the policies, procedures, and strategies that govern an institution’s audit function altogether, covering every major activity, IT audit included.
• Audit Plan: the schedule of specific audits planned for a given period, usually a year, covering what will be audited, the type of work planned, the objectives and scope, and details like budget, resource allocation, schedule dates, and the type of report that gets issued.