At least annually, the Chief Audit Executive will submit to senior management and the ACR an internal audit plan for review and approval. The internal audit plan will consist of a work schedule as well as budget and resource requirements for the next year. The Chief Audit Executive will communicate the impact of resource limitations and significant interim changes to senior management and the Board.

The internal audit plan will be developed based on a prioritization of the audit universe using a risk-based methodology, including input of senior management, the ACR, and Board.

The Chief Audit Executive will review and adjust the plan, as necessary, in response to changes in the organization’s business, risks, operations, programs, systems, and controls. Any significant deviation from the approved internal audit plan will be communicated to senior management and the ACR through periodic activity reports.