Planning for internal audits should be flexible in order to permit changes in emphasis based on findings and objective evidence obtained during the audit.