In times past, auditors often examined planning documents to validate their audit universe and other planning tools. The new paradigm reverses the relationship to use the strategic plan to create the audit universe. That way, the audit universe contains the essential elements to support the overall business plan. The second major insight is the use of risk scenarios in developing macro risk assessment and annual audit plans. Scenario planning may be a better macro risk assessment tool in times of significant change, such as merger, acquisition and divestiture of major business units.
Scenarios have the ability to combine both qualitative and quantitative data in imaginative ways.
Risk factors and risk models, part of the current paradigm, have increased importance in the new paradigm. Nevertheless, macro risk assessment depends on observable or measurable factors to substitute for the direct measurement of risk. The new paradigm suggests new ways to use risk factors and risk models that derive directly from the business process instead of the audit process. Additional work on normative tables points to using them as a means of measuring and modeling risk. They make using risk factors easier to use and more consistent.