Audit universe

The universe is the denominator. The plan is a selection from it, and the honesty of the plan depends entirely on whether the universe is complete. A universe that quietly omits the things nobody wants to audit produces a plan with excellent coverage of a partial world.

Two problems are chronic. The first is staleness: universes assembled from an org chart three reorganisations ago, missing the systems and third parties that carry the actual risk. The second is granularity mismatch — entries ranging from “Treasury” to “vendor master file maintenance”, which makes any coverage percentage meaningless because the units are not comparable.

Where modern tooling helps is in making the universe derived rather than declared. If risks are linked to controls and controls to systems and processes, coverage can be computed — which areas have had assurance, when, and with what result — instead of being asserted in a spreadsheet each autumn. The plan then becomes a decision made against evidence, and, more importantly, one that can be revisited during the year when the evidence changes.