What should be included in the proposal to management regarding the audit program?

Including key high-risk auditable entities based on risk assessment in the proposal to management is crucial for several reasons. First and foremost, identifying entities with heightened risk allows the audit program to focus its resources and efforts where they are most needed, ensuring that potential issues are addressed proactively. This targeted approach not only enhances effectiveness but also supports the organization's overall risk management strategy.

Moreover, incorporating risk assessment findings into the audit program proposal demonstrates to management that the audit team is aligning its activities with the organization's strategic objectives and risk appetite. This alignment is essential for gaining management buy-in and fostering a collaborative atmosphere between the audit function and organizational leadership.

Additionally, addressing high-risk areas reinforces the idea that audits are not just compliance exercises but are integral to safeguarding the organization’s assets and improving its operational efficiency. This focus can lead to more valuable insights and recommendations, which are often more appreciated by management.

While general audit guidelines and procedures, budget estimations, and historical data from past audits can be important components of an audit program, they do not carry the same weight in terms of strategic focus and risk prioritization as identifying high-risk auditable entities. Thus, pinpointing these entities based on risk assessment stands as a key element in an effective audit program proposal.