The three year rolling Internal Audit Plan as well as the Annual Internal Audit Plan is risk-based and approved by the Audit, IT and Risk Management Committee of Council.