The Internal Audit Strategic Plan: What Standard 9.1 Actually Requires

The 2025 IIA Global Internal Audit Standards introduced a number of changes that internal audit functions are still working through. Some were refinements of existing requirements. Others were genuinely new obligations with no direct equivalent in the 2017 IPPF.

The internal audit strategic plan is one of the latter.

Standard 9.1 — Plan Strategically — sits within Domain IV: Managing the Internal Audit Function. It requires the chief audit executive to develop and maintain a strategic plan that aligns the internal audit function's direction with the organization's strategic objectives. This is not a rebranded version of the annual audit plan. It is a distinct document with a distinct purpose, and the distinction matters.

What Standard 9.1 Actually Requires

The standard requires the CAE to establish a vision for the internal audit function — a clear articulation of what the function is working toward and what role it intends to play within the organization over a multi-year horizon. That vision must be grounded in the organization's strategic direction, not just its current risk profile.

From that vision, the CAE is expected to perform strategic scanning and analysis: assessing the internal and external factors that will shape the function's operating environment over the planning period. This includes changes in the organization's strategy, shifts in the risk landscape, emerging regulatory requirements, technology developments, and resource constraints. The strategic plan is the CAE's documented response to that analysis.

The plan must define strategic objectives — the specific outcomes the function is working to achieve over the planning horizon — along with the initiatives and investments required to reach them. It must also identify key dependencies: the organizational conditions, resources, and relationships that the function's strategy relies on, including the board's support for the internal audit mandate.

Finally, the standard requires that the CAE monitor progress against the strategic plan and communicate results to the board and senior management. The plan is not a one-time document. It is a living framework that is reviewed and updated as the organization's priorities and the function's operating environment evolve.

How It Differs from the Annual Audit Plan

The distinction between the strategic plan and the annual audit plan is one of the most important things to understand about Standard 9.1 — and one of the most commonly misunderstood.

The annual audit plan is an operational document. It defines the engagements the function will conduct in the coming year, based on the risk assessment and available resources. It answers the question: what will internal audit do this year?

The strategic plan is a directional document. It defines where the function is headed over a multi-year horizon and how it will build the capability, credibility, and organizational positioning to get there. It answers a different set of questions: what does this function need to become? What investments in people, methodology, and technology are required? How will the function demonstrate its value to the board over time?

These two documents serve different purposes, are written for different audiences, and operate on different timescales. A function that treats its annual audit plan as its strategic plan is not meeting the Standard 9.1 requirement — regardless of how well-constructed the annual plan is.

What the Strategic Plan Must Contain

The IIA's Global Practice Guide on developing an internal audit strategy, issued in October 2025, provides the most detailed guidance on what the strategic plan should include. The IIA also released a customizable strategic plan template as a companion tool.

At a minimum, a conforming strategic plan should address the following components.

Purpose, vision, and values. The plan should articulate why the internal audit function exists within the organization, what it is working toward, and the principles that guide how it operates. These are not generic statements — they should reflect the specific context of the organization and the CAE's view of the function's role.

Strategic objectives. These are the multi-year outcomes the function is committed to achieving. They might include building a more risk-intelligent audit approach, strengthening the function's relationship with the audit committee, developing staff capability in emerging risk areas, or implementing technology to improve audit efficiency. Each objective should be specific enough to be measurable and meaningful enough to require deliberate effort.

Key dependencies. The plan should identify the organizational conditions that the function's strategy depends on — including board support, adequate resourcing, access to data and systems, and management's cooperation with the audit process. Surfacing these dependencies is important both for planning purposes and for the CAE's communication with the board.

Initiatives and investments. For each strategic objective, the plan should identify the specific actions, projects, or investments required to achieve it. This is where the strategic plan connects to resource planning and budget discussions with senior management.

Progress monitoring and reporting. The plan should define how the CAE will track progress against strategic objectives and how that progress will be communicated to the board and senior management. This is the mechanism that keeps the strategic plan active rather than static.

Why This Requirement Is Significant

For functions that have operated without a formal strategy, Standard 9.1 represents a meaningful shift in how the CAE's role is defined. The 2017 IPPF did not include an equivalent requirement. The expectation that the CAE would think and operate strategically existed in the profession's broader guidance, but it was not a standards-level mandate.

The 2025 standards changed that. The CAE is now explicitly required to plan strategically — to think beyond the current audit cycle, to position the function for the organization's future, and to communicate that positioning to the board in a structured, documented way.

This has practical implications for how CAEs spend their time, how they engage with the board, and how they make the case for resources. A CAE who can present a credible multi-year strategy — grounded in the organization's direction, responsive to the risk environment, and tied to measurable objectives — is a fundamentally different kind of partner to the board than one who arrives each year with an audit plan and a budget request.

What Conformance Looks Like in Practice

Conformance with Standard 9.1 is not primarily a documentation exercise. It is a strategic thinking exercise that produces documentation.

The most common failure mode is producing a strategic plan that looks complete on paper but was not built through genuine strategic analysis. A plan that lists objectives without connecting them to the organization's direction, or that identifies initiatives without assessing the dependencies required to execute them, satisfies the form of the requirement without the substance.

A genuinely conforming strategic plan starts with the CAE's honest assessment of where the function is today — its current capabilities, its gaps, its relationship with key stakeholders — and a clear-eyed view of where the organization is headed. From that foundation, the plan articulates a credible path from the current state to the desired future state, with the objectives, initiatives, and dependencies that make the path navigable.

For most functions, building that plan for the first time requires dedicated time and, often, an outside perspective. The current-state assessment is harder to conduct objectively from inside the function. The strategic scanning exercise benefits from a structured approach. And the translation from analysis to objectives and initiatives is a skill that many CAEs have not had occasion to develop — because until January 9, 2025, it was not a standards-level requirement.

LH Consulting Group works with chief audit executives to develop internal audit strategic plans that meet the Standard 9.1 requirement and serve as genuine operational tools — grounded in the organization's context, aligned to the function's current capabilities, and built to be used rather than filed. If your function is working through what the strategic plan requirement means in practice, that is exactly the kind of work we do.