30-60-90 day plan for audit managers

A 30-60-90 day plan for a new internal audit manager should spend the first 30 days mapping the audit plan, the open engagements and every past-due finding; days 31-60 supervising engagements, reviewing workpapers and testing how findings get closed; and days 61-90 refreshing the risk assessment that drives next year's plan and reporting to the chief audit executive and the audit committee. As of November 2026, the work is judged against the IIA's Global Internal Audit Standards, effective January 9, 2025, and their topical requirements: Cybersecurity has been effective since February 5, 2026, Third-Party since September 15, 2026, and Organizational Behavior takes effect December 15, 2026.

This plan is for the chief audit executive, audit committee chair or CFO hiring an internal audit manager who leads engagements and supervises auditors; the last section adapts it for an audit manager at a CPA firm. The controls a controller owns are in the 30-60-90 day plan for controllers; the compliance program in the 30-60-90 day plan for compliance officers; and the second-line risk function in the 30-60-90 day plan for risk managers. Nothing here is legal or accounting advice.

What does an internal audit manager own that an external audit manager does not?

The IIA's updated Statement of Position on the Three Lines Model, published July 8, 2026, places internal audit in the third line and says that when internal audit carries out a second-line responsibility, it "creates a direct self-review threat"; the safeguards it lists include a documented justification, full disclosure to the board and assurance over the area from another independent party (IIA Statement of Position). A new manager should know which of the department's activities, if any, are second-line work.

What does the 30-60-90 day plan look like?

30-60-90 day plan — [Name], Internal Audit Manager, [company]
Reports to: [chief audit executive]    Committee: [audit committee]
Start date: [date]    Team: [N] auditors, co-source: [firm, if any]
Plan year: [year]    SOX: [yes / no]    Audit tool: [ ]

DAYS 1-30 — Map the plan, the findings and the people
Goals:
- Read the charter, the current audit plan and status, the last
  risk assessment and the last committee report
- List open engagements: scope, budget, hours used, stage, owner
- List open findings: rating, owner, due date, evidence of closure
- Read the last external quality assessment and its actions
- For each engagement in the plan, check whether an IIA topical
  requirement applies, and whether the assessment is documented
- Meet the CAE, CFO, controller, CISO, compliance, the external
  auditors and the owners of past-due findings
Deliverables by day 30:
- Engagement status and past-due findings list agreed with [CAE]

DAYS 31-60 — Run engagements and test follow-up
Goals:
- Lead or supervise [2] engagements; review workpapers to the
  department's methodology; clear review notes within [5] days
- Sample [10] closed findings and confirm the evidence supports
  closure; reopen any that do not
- Coach each auditor on one review point; agree development goals
- With the CAE, map SOX testing status (if applicable) and the
  external auditors' reliance plan
Deliverables by day 60:
- [2] engagement reports issued or in final review
- Findings follow-up results with recommendations

DAYS 61-90 — Refresh the risk assessment and the plan
Goals:
- Interview leaders for next year's risk assessment
- Draft the risk-based audit plan: engagements, hours, skills,
  co-source needs, topical requirements expected to apply
- Draft the committee update on plan status and past-due findings
Deliverables by day 90:
- Draft audit plan reviewed by [CAE]
- One improvement agreed (example: a findings follow-up cadence,
  or a workpaper review checklist)

Check-ins: weekly with [CAE]; reviews at day 30, 60 and 90.

Numbers in brackets are examples. Size them to the department, the plan and the SOX scope.

Which standards and rules set an audit manager's calendar?

As of November 2026, from the IIA, the SEC, NYSE and COSO. Industry regulators, such as bank examiners and state insurance departments, add their own expectations.

How do the topical requirements change the audit plan?

The IIA says topical requirements apply to assurance engagements when a risk assessment makes the topic the subject of an engagement in the plan, when the topic comes up during an engagement, or when an engagement on it is requested outside the plan. Auditors must keep evidence that each requirement was assessed for applicability and a documented reason for any requirement left out; for advisory work they are recommended, not required (IIA).

In practice, a new manager adds three things to the first month:

1. An applicability column in the plan. For every assurance engagement, list which topical requirements apply and where the assessment is filed. A cybersecurity or vendor engagement in the plan almost certainly triggers one.
2. A check in the workpaper template. Each engagement's planning memo records the applicability decision and the reason for any exclusion.
3. Next year's dates. Organizational Behavior takes effect December 15, 2026 and Organizational Resilience April 30, 2027, so engagements planned now for 2027 should be scoped with them in view.

Which numbers should a new audit manager baseline?

The measures are examples. Agree them with the chief audit executive and use the same ones in every committee update so trends show.

What does "on track" look like at day 30, 60 and 90?

A filled example

How should the hiring manager use this plan in the final interview?

Give every finalist the same brief: a disguised audit plan with status, a findings list with dates, and one stalled engagement. Score the plans with the rubric in how to evaluate a 30-60-90 day plan in an interview. A strong plan reviews closure evidence before it reports improvement, and knows which topical requirements the plan triggers. Questions that test it:

• "A finding owner says the fix is done but cannot show evidence. What happens next?"
• "Which topical requirements apply to the engagements in this plan, and how would you document it?"
• "A senior auditor's workpapers do not support the conclusion. How do you handle the review?"
• "The CFO asks you to drop an engagement in their area this year. What do you do?"

The internal auditor screening questions cover SOX testing and credentials earlier in the process, and the interview guide for finance roles covers the wider loop.

What should the chief audit executive ask at the check-ins?

• Day 30: Which past-due findings worry you most, and why are they late? Which engagements trigger topical requirements?
• Day 60: What did the closure sample show? Which review notes keep recurring on the team?
• Day 90: What are the three biggest risks the plan does not yet cover? What skills or co-source hours does the plan need?

What the chief audit executive owes a new audit manager

• Access to the audit committee materials and, when appropriate, a seat at the meeting.
• The methodology, workpaper standards and the last quality assessment with its open actions.
• An introduction to finding owners as someone with the department's authority.
• Clear sign-off authority: which reports the manager can issue, and which need the CAE.
• The history: disputed findings, scope limitations and any past independence concerns.

Common mistakes

• Closing findings on management's word. Closure needs evidence the auditor has seen.
• Copying last year's plan. The plan must follow a fresh risk assessment.
• Treating topical requirements as a checklist for later. The applicability assessment belongs in each engagement's planning.
• Reviewing for format, not support. A tidy workpaper that does not support its conclusion is the larger risk.
• Taking on management work. Designing the control you will later audit weakens independence.

Adapting the plan

• Audit manager at a CPA firm: replace the internal plan with the client portfolio, budgets, staffing and review of staff workpapers. For firms that audit public companies, QC 1000 takes effect December 15, 2026; the amendments the SEC approved on November 2, 2026 rescind the external quality control function requirement, let firms choose the date of their annual evaluation (after at least five months of operation the first time) and shorten the retention of QC system documentation from seven to five years (SEC order, 91 FR 69620). The same order notes that the AICPA's SQMS No. 1 took effect December 15, 2025.
• SOX-heavy departments: weight months one and two toward the testing calendar, deficiency evaluation and the external auditors' reliance on internal audit's work.
• Small or co-sourced functions: the manager may run every engagement personally; add the co-source contract, its scope and its quality review to month one.
• Credentials: the IIA's Certified Internal Auditor is a three-part exam, with one year of internal audit experience for holders of a master's degree and two years with a bachelor's, as of November 2026. ISACA's CISA fits IT audit roles, and CPA licenses can be checked on CPAverify. For sourcing candidates, see the Boolean search strings for auditors.