An integrated FAHP-MCGP approach to project selection and resource allocation in risk-based internal audit planning: A case study

Effective audit planning could drive internal audit function to be the catalyst for company development by launching audit projects that protect and create organization value. In the risk-based internal audit planning process, once risk assessment is completed, audit projects should be selected and resources are allocated accordingly. However, an optimal annual audit plan cannot be realized based on subjective selection of projects and manual distribution of available hours merely. In the planning process, the risk level that can be mitigated by performing individual audit project is vague and there is also uncertainty with the time to be spent on each project. By developing a structured three-phase framework for risk-based audit planning, this paper proposes a novel approach that combines fuzzy analytic hierarchy process (FAHP) and multi-choice goal programming (MCGP) to fill the gap between prioritization and allocation technique. An exploratory estimation of risk reduction factor for each candidate project is performed using FAHP, and then MCGP assists in making a more informed choice so as to minimize the total deviations from predefined goals concerning the risk coverage, flexibility and optimal mix of project portfolio. A real case study of annual audit plan for a global internal audit team is presented to illustrate how the proposed FAHP-MCGP approach could be applied in practice. The results of this research indicate that the proposed FAHP-MCGP approach is a useful tool for selecting potential projects and allocating staff time during risk-based internal audit panning and has substantial practical application.