How does Internal Audit decide when to perform an audit?

Internal Audit has a five-year plan that covers all academic schools and central systems. Some of these areas are audited annually; others are looked at between one and three times over the five-year period. The frequency of audit is determined by a risk based model that uses the the University's strategic framework and its Risk Register to determine all the 'auditable' activities and the level of risk that they represent.  Some areas are audited annually to give assurance to the external auditors that adequate financial controls are in place.