Photo by Berke Citak on Unsplash
SPI resources are always limited, while the units that could be audited are almost unlimited: faculties, bureaus, research institutes, business units, and information systems. The annual oversight plan answers one important question: of everything that could be audited, what must be audited this year, and why?
This article covers the annual oversight work program (PKPT) of a university SPI, the regulations and standards behind it, the components it should contain, how to prepare it based on risk, an illustrative example, and how to monitor its implementation. References were checked as of October 21, 2026.
What Is the SPI's PKPT?
PKPT stands for program kerja pengawasan tahunan, the annual oversight work program: the plan of audits that an oversight unit will carry out in one year. The term PKPT is commonly used in government internal oversight bodies. For BLUs, Minister of Finance Regulation 129/PMK.05/2020 calls it the annual work program plan for Internal Oversight. The substance is the same: a list of engagements with their objectives, scope, resources, and schedule.
In professional standards, the equivalent is the internal audit plan (internal audit plan) in GIAS Standard 9.4. How to prepare a work program for a single engagement is discussed separately in the article on internal audit work program. That standard is discussed more broadly in the article GIAS 2024 for university SPIs. The charter that serves as the basis of the plan is in the article SPI internal audit charter, and aligning schedules with the audit committee, inspectorate, and external examiners in the article SPI coordination.
What Are the Regulatory and Standards Bases for the Annual Oversight Plan?
| Reference | Provision |
|---|---|
| Minister of Finance Regulation 129/PMK.05/2020 Article 255 (BLU) | The SPI prepares an annual work program plan for Internal Oversight and submits it to the head of the BLU for approval. Unscheduled and/or confidential oversight can be excluded from the plan. |
| Regulation 129 Article 256 | The SPI carries out oversight based on the plan approved by the head of the BLU |
| Annex of Regulation 76/2025 | Sets out the six contents of the annual work program plan for Internal Oversight |
| GIAS 2024 Standard 9.4 | A plan based on a documented assessment of strategies, objectives, and risks, performed at least annually, and updatable |
For general state universities, PTN-BH, and PTKN, the regulations referenced in this article do not detail the format of the annual plan. Campuses can therefore use the BLU components and the GIAS as practical references. The legal basis of the SPI for each type of institution is discussed in the article University SPI.
What Are the Components of the Annual Work Program Plan?
The annex of Regulation 76/2025 states that the annual work program plan for Internal Oversight contains six elements:
| No | Components | Example content for a campus |
|---|---|---|
| 1 | Information and background on the object of oversight, including the implementation of follow-up on previous oversight results and its impact | Unit profile, last year's audit results, and the status of unresolved recommendations |
| 2 | Scope or coverage of the oversight work | The period examined and the processes covered |
| 3 | Object of oversight | The faculty, bureau, institute, or system being audited |
| 4 | Oversight techniques used | Compliance audit, review, audit for specific purposes, data analysis |
| 5 | Resource allocation | Number of auditors and working days per engagement |
| 6 | Schedule | Quarter or month of implementation |
How Do You Prepare a Risk-Based Oversight Plan?
- Map the audit universe. List all units, processes, programs, and systems that could be audited.
- Understand campus objectives and risks. GIAS Standard 9.4 asks for an assessment of strategies, objectives, and risks, with input from leadership and the oversight body. The risk profile from the risk management unit is a main input, as discussed in the article university risk management.
- Rate and rank risks. Score the impact and likelihood of each object, then rank from highest.
- Consider mandatory areas. Standard 9.4 mentions coverage of information technology governance, fraud risk, and the effectiveness of compliance and ethics programs. Also add areas requested by regulations or leadership.
- Match with capacity. Calculate the available person-days, then decide which engagements fit and which must be deferred.
- Coordinate with other reviewers. Align the schedule with quality assurance and external auditors so that units are not reviewed at the same time.
- Draft and approve. Submit the plan to leadership for approval, then communicate it.
The full approach is discussed in the article risk-based audit.
What Does a University SPI PKPT Example Look Like?
The following table is an illustrative example. The person-day figures and schedule are only a picture, not a standard:
| No | Object of oversight | Purpose | Risks | Technique | Allocation | Schedule |
|---|---|---|---|---|---|---|
| 1 | Procurement of goods and services, first semester | Assess process compliance and price reasonableness | High | Compliance Audit | 3 auditors, 20 days | Quarter I |
| 2 | Management of research funds | Assess whether fund use matches contracts and reports | High | Performance and compliance audit | 3 auditors, 25 days | Quarter II |
| 3 | Receipts from students | Assess recording, deposit, and reconciliation | High | Review and transaction testing | 2 auditors, 15 days | Quarter II |
| 4 | State assets | Assess recording and stock-taking | Currently | Physical testing | 2 auditors, 15 days | Quarter III |
| 5 | Access control over academic and financial systems | Assess access rights and audit trails | Currently | Information Systems Audit | 2 auditors, 15 days | Quarter III |
| 6 | Follow-up on prior-year recommendations | Ensure recommendations are implemented | High | Monitoring and confirmation | 1 auditor, 10 days | Quarter IV |
The plan can also leave capacity for unscheduled audits. Article 255 paragraph (2) of Regulation 129 recognizes that unscheduled and/or confidential oversight can be excluded from the plan, for example an examination of a complaint. Audit guidance for the objects in the example table: procurement, research funds, and the academic system. Complaint channels are discussed in the article university whistleblowing system.
How Is the Plan Updated Through the Year?
GIAS Standard 9.4 states that the plan must be dynamic and updated in a timely way when the business, risks, operations, programs, systems, controls, or organizational culture change. The chief audit executive also needs to communicate to the board and senior management in a timely way:
- the impact of resource limitations on audit coverage;
- the rationale for not including an assurance engagement in a high-risk area;
- conflicting demands for services between major stakeholders, such as high-priority requests due to emerging risks and requests to replace planned assurance engagements with advisory engagements; and
- limitations on scope or restrictions on access to information.
The same standard asks the chief audit executive to discuss the plan, including significant interim changes, with the board and senior management, and the plan and its significant changes are approved by the board. In practice, the SPI can set a mid-year review and change rules: new engagements come in, old ones are deferred, and the decision is recorded and reported.
How Does the Plan Relate to Reporting and Follow-Up?
At a BLU, the SPI prepares oversight reports and submits them to the head of the BLU and the supervisory board (Article 257). The SPI also monitors and encourages the follow-up of recommendations from the SPI, government internal oversight bodies, external auditors, and the BLU supervisor, then reports the results, which at a minimum contain the findings and recommendations, the target completion time, and the completion status (Article 260).
These follow-up engagements should be included in the plan, as in the last row of the example above, so that monitoring does not depend on memory.
What Are Common Mistakes When Preparing a PKPT?
- Auditing the same units every year. The plan is copied from the previous year without a new risk assessment.
- An unrealistic plan. The number of engagements exceeds the available person-days.
- Leaving no room. There is no capacity for special audits or leadership requests.
- Not coordinated. One unit is audited by the SPI, quality assurance, and external auditors in the same week.
- Not updated. Risks change, the plan stays the same.
How Does Internal Audit Software Help?
Audithink helps the SPI manage the oversight plan through six main features: risk assessment to map risk areas, audit planning based on risk assessment results, work program templates for each engagement, deadline notifications, monitoring of recommendation follow-ups, and automated reports. Risk assessment and prioritization decisions remain with the auditors. Campus audit needs are discussed on the page Audithink for Educational Institutions.
FAQ About the University SPI's PKPT
What is PKPT?
PKPT is the annual oversight work program, a one-year audit plan that sets out the objects, objectives, scope, techniques, resources, and schedule of oversight.
Must the SPI's PKPT be approved by leadership?
At a BLU, Article 255 of Minister of Finance Regulation 129/PMK.05/2020 requires the SPI to submit the annual work program plan to the head of the BLU for approval. For other types of institutions, follow the statute and campus policy.
What does the annual work program plan contain?
The annex of Regulation 76/2025 lists six elements: information and background on the object, scope, the object of oversight, oversight techniques, resource allocation, and schedule.
How often is the risk assessment for the audit plan performed?
GIAS Standard 9.4 requires the risk assessment underlying the audit plan to be performed at least annually, and the plan to be updated when conditions change.
May the SPI carry out audits outside the plan?
Yes. Article 255 paragraph (2) of Regulation 129 recognizes that unscheduled and/or confidential oversight can be excluded from the plan. Changes to the plan still need to be recorded and reported.
What is the difference between PKPT and an audit work program?
The PKPT is the plan for all engagements in a year. An audit work program is the detailed steps for a single engagement, covering the criteria, tasks, methodology, and assigned auditors.
Conclusion
A good oversight plan answers two things: what are the campus's biggest risks, and what can the SPI realistically do this year. With complete components, a documented risk assessment, and updates throughout the year, the plan becomes a working tool, not just a document.
If the SPI at your campus wants to prepare its annual plan and monitor its implementation more neatly, schedule an Audithink demo.
