A local government internal audit function always has more technology to examine than it has hours to examine it. The financial ERP, the identity platform, public safety systems, and dozens of applications are all plausibly in scope, and no team can reach them all in a single year. Every IT audit plan is, at its core, a decision about where to concentrate a scarce resource. Most plans make that decision by habit, rotating through systems on a familiar cadence and presenting the rotation as coverage. It looks orderly, but it optimizes for the wrong thing. What you will get:

• How risk concentrates across security, financial, operational, and control exposure

• The six-step method for building a multi-year, risk-based IT audit plan

• What a defensible plan documents about the systems it excludes, and why

• How a full risk assessment translates into a one-page plan your audit committee can approve