Risks and business conditions change all the time, so an annual plan or even one that is updated quarterly won’t lead to auditing what matters today. You audit what used to matter.
Bruce Turner, “an active company director and audit committee chair”, was recently interviewed on this topic. You can see the full interview at CERM Risk Insights and there is also an article in Future of Professions.
Richard Chambers has shared his valuable insights in another post. In Europe’s Internal Auditors Are Already Identifying the Risks for 2021 he makes a number of excellent observations, especially his opening paragraph.