Risk-Based Internal Audit Plan & Audit Universe for Hotels: Hotel Internal Audit Plan Template with Risk Scoring

Full description

For hotel general managers, internal auditors, finance controllers and owners who need an audit plan they can defend. The workbook lists 60 auditable units and scores each one from facts: the value it handles, the exposure if it fails, incidents, staff turnover, the last audit result and the findings still open. Impact, likelihood and control weakness multiply into a score from 1 to 125. The score sets a High, Medium or Low rating, and the rating sets the years between audits: 1 year, 2 years or 3 years. A severe-exposure floor and an override stop a unit from being left on a long cycle after an incident. The planner enters the first planned quarter for each unit, the workbook builds a 12-quarter calendar, and the Resources tab compares the hours in every quarter with auditor capacity after reserve and season. An audit register tracks delivery, report timing and follow-up. A companion workbook scores one audit against 40 coded standards and lists its findings. A 12-page guide covers the method, the routine and the forms.

What is inside

• Risk_Based_Audit_Plan.xlsx: 12 tabs, 4,829 formulas, 2 native charts, 26 drop-down and input rules
• Audit Universe: 60 sample units in 8 categories plus 10 spare rows, with owner role, complexity and risk drivers
• Risk Scoring: the engine, one column per step from drivers to score, band, final rating, years between audits, hours and rank
• Audit Plan and Plan Calendar: due date, due quarter, planned quarter, timing flag and audit hours by unit across 12 quarters
• Resources: hours against capacity by quarter, steady-state load by rating and utilisation flags
• Audit Register: 37 sample year-1 audits plus 30 spare rows, with status, fieldwork, report, response and result band
• Sensitivity: two 5 x 5 what-if grids on audit hours and utilisation
• Dashboard with 9 tiles, a check tile and 2 charts; 15 integrity checks; Method tab with 18 documented calculations
• Risk_Based_Audit_Plan_Audit_Programme.xlsx: 5 tabs, 600 formulas, 40 coded standards in 8 domains, a findings sheet with agreed dates, a summary and 9 checks
• Risk_Based_Audit_Plan_Guide.docx and PDF: 12 pages with the scoring method, four units worked through, the hours test, the audit routine, an annual summary outline and printable forms
• README.txt and LICENSE-and-Terms.txt

How it works

1. Set the plan start, auditor capacity and the scoring criteria on Assumptions, and replace the sample units in Audit Universe.
2. Read the score, the rating and the due date for each unit. Set a floor or an override where an incident or the law requires it.
3. Enter the planned first quarter for each unit and read the Resources tab. Move units until no quarter is over capacity.
4. Run each audit with the companion programme, then record the dates and the result band in the register.
5. Read the dashboard each month, chase late items and send the annual summary to the owner.

Details

• Formats: 2 Excel workbooks (.xlsx), 1 guide in Word (.docx) and PDF, English
• Software: Excel 2016 or later, or LibreOffice Calc 7 or later
• No macros, no external links, no data tables, no array formulas
• 4 files plus README and license; instant digital download

Good to know

• Sample data is illustrative. Units, criteria, bands, frequencies and hours are examples to replace with your own.
• Some safety, food-safety, water-safety and payment-card checks have a required frequency set by law, an insurer or a standard-setting body. Verify local requirements and set the floors to match.
• The files are management tools, not legal advice or a certified audit.
• Use role titles or codes for people in shared copies, never names.
• Single-user license. Do not redistribute.

FAQ

How is the risk score built?

Impact is the higher of the value band and the exposure score. Likelihood is the rounded average of the incident band and the turnover band. Control weakness is the higher of the last-result score and the open-findings band. The three multiply into a score from 1 to 125.

Can I change the criteria, bands and frequencies?

Yes. The criteria tables, score bands, years between audits, hours by complexity, capacity, reserve, seasonal share and the severe-exposure floor are all inputs on Assumptions. The checks warn you if a table is out of order.

What if the plan needs more hours than the auditors have?

The Resources tab flags every quarter above capacity and every tight quarter. Change the planned quarter of a unit and the load moves with it. The guide works through one example.

Does it handle units that were never audited?

Yes. A unit with no audit date is treated as a weak control and is due at the plan start. The sample includes three such units.

Do I need macros or add-ins?

No. Every result is a standard worksheet formula, including the sensitivity grids.