We currently outsource our IT audit. We have an IT Risk Assessment but were informed that we also need an IT Audit Plan. In looking at our risk assessment and comparing to the outsourced IT audit scope, it seems to be in line (based on our knowledge). I have reviewed the Regulatory IT Audit Examinations but still having a hard time grasping what the bank needs and how it should differ from the outsourced audit plan. Could someone point me in the direction of how to create an audit plan that differs from the outsourced created audit plan/scope? I am a little lost. Thanks in advance!

We also outsource our IT audit work. In my audit plan, I identify what areas will be covered by Internal Audit (ie wire transfers and ACH Audit) and which areas will be covered by IT Audit Firm (ie penetration test work, hardware configuration, network security).

Thank you so much for your response! We outsource 100% of IT audit and that is noted. It also notes the oversight, how scope is determined (based on managements risk analysis, audit frequency, etc. Hopefully, I have covered it all. Does your internal auditor conduct the audit risk assessment seperately from the outsourced auditor? Or is the external's risk assessment reviewed for agreement? Thanks again! You have been very helpful!

The audit department does not perform a full blown risk assessment. In the audit plan, we identify areas being covered by 3rd party and areas covered by audit.