Year 2000 compliance issues, and project management for year 2000 preparation were very late arriving on many internal auditing radar screens. Nonetheless, many organizations have determined, or will soon learn, that it is the most critical issue in the entire audit universe. Of course, after that significant date changes it will soon drop off the priority list again and be replaced by year 2000 recovery management issues, projects, damage control, and litigation. P lanning and scheduling Audit planning is both strategic and tactical. The inventory of the audit universe, priority for audits, and availability of audit resources provide input to the strategic audit schedule.
Tactical planning is performed for each audit project.
Strategic scheduling factors are both logical and logistical. For example, known problems with systems development methods, system and program change control, or access controls should be addressed before auditors consider getting involved in individual systems development projects or application system reviews. Weaknesses in key control areas such as access management and change control can also impact the reliability of any information used by auditors and may impact the scope and time required to assess and test controls. Software tools can assist in assessing available auditor skills and assigning the appropriate people to specific audit project teams. The software should support assignment of auditors with critical skills as needed within an audit project, and allow them to proceed to other projects once their tasks are completed even if the audit is not finished.