A key planning step for internal auditors to establish appropriate engagement objectives is to evaluate management's risk assessment and the internal audit activity's risk assessment. This step ensures that the audit focuses on areas of highest risk and aligns with the organization's risk management framework. By understanding and incorporating the organization's risk priorities, the internal auditors can design their engagements to provide maximum value and assurance regarding the control environment and risk management processes.
Reference:
The Institute of Internal Auditors (IIA) Standard 2010: Planning
IIA Practice Advisory 2010-2: Using the Risk Management Process in Internal Audit Planning