Consulting engagements provide the internal audit activity with flexibility to add value and do not need to be included in the long-range audit plan.

The internal audit activity's plan of engagments must be based on a formal quantitative risk assessment.

The chief audit executive should consider changes to the long-range audit plan based on the requests of business unit managers.

A risk assessment on which to base the internal audit activity's long-range plan must be undertaken at least once every three years.