In implementation guide for it is written: Internal auditors may hold discussions with the management of the area under review to understand the strategies and objectives. These discussions may be supplemented by a review of strategy papers, business plans, budgets, and minutes of meetings. Significant risks may be identified in the supporting documentation. Internal auditors can use their understanding of the business and knowledge of the environment to independently evaluate the risk factors considered by business management.
Understanding the strategies, objectives, and risks of the area or process to be audited can help internal auditors to evaluate the adequacy and effectiveness of the its governance, risk management, and control processes. Internal auditors may review the organization structure, management roles and responsibilities, management reports, and operating procedures to gain an understanding of the governance, risk management, and control processes. It is also important for internal auditors to review meeting notes during the planning phase of an engagement to determine whether any additional tests should be added to the work program.