Most airline audit universes were not designed for airlines. They were inherited — from a group parent, a Big Four methodology, a predecessor CAE, or an off-the-shelf risk library built for banks and manufacturers. The entity list looks orderly: financial reporting, payroll, procurement, treasury, IT general controls, health and safety. Everything on it is auditable. Very little of it explains why the airline made or lost money last year.
The symptom: clean opinions, unexplained results
The tell is a familiar one. Internal audit issues a run of satisfactory reports across finance and compliance entities, while the same year brings a revenue shortfall nobody predicted, a fuel-hedge outcome nobody scrutinised, and a distribution-cost overrun nobody owned. The audit committee is left holding two documents that do not speak to each other: an assurance summary that says controls are adequate, and a management-accounts pack that says performance is not.
That gap is not an execution failure by the audit team. It is a design failure in the universe. If revenue management, network profitability, alliance settlement and slot utilisation are not entities in the universe, no annual risk assessment — however diligent — will ever rank them, and no plan will ever reach them.
Why borrowed universes miss the point
A generic universe is organised around the general ledger and the organisation chart. An airline's risk is organised around the network, the aircraft and the booking curve. Three structural mismatches follow.
- Value sits in decisions, not transactions. An airline's largest exposures are recurring commercial decisions — pricing and inventory settings, capacity deployment, codeshare economics, fleet and maintenance timing. Transaction-cycle audits pass over them entirely.
- Money moves through industry mechanisms. Interline billing through clearing houses, agency settlement through BSP and ARC, proration of multi-carrier journeys, EU261-style compensation regimes — none of these appear in a cross-industry risk library, and each carries material leakage and dispute risk.
- The cost base is contractual and technical. Fuel, leases, maintenance reserves, ground handling and airport charges are governed by long, negotiated contracts with complex entitlements. Auditing "accounts payable" tells you invoices were approved; it does not tell you whether the airline claimed what its contracts entitle it to.
An audit universe should read like a map of where the airline's money is made, moved and lost — not like a chart of accounts with audit hours attached.
Rebuilding around the value chain
The remedy is to draw the universe from the airline's own economics before consulting any template. In practice that means walking the value chain end to end: how demand is forecast and priced; how seats and cargo space are sold through direct, agency, interline and group channels; how the flight is produced — fuel, crew, airport, handling, maintenance; and how cash is collected, prorated, settled and refunded. Each stage yields auditable entities with owners, systems and money attached.
A value-chain universe surfaces entities a generic one never names: revenue-management override behaviour, group-sales materialisation, ancillary revenue collection, wet-lease oversight, warranty and guarantee recovery, disruption-cost recovery from handling partners, loyalty-programme partner billing. These are precisely the areas where assurance is thinnest, because no one has ever been asked to look.
Weighting the plan honestly
A rebuilt universe still fails if the risk assessment quietly restores the old weighting. Two disciplines keep it honest. First, size entities by money at risk — the revenue or cost that flows through them and the plausible loss mechanisms within them — rather than by audit familiarity or the availability of a ready-made work programme. Second, record explicitly which high-value entities the plan does not cover this year and say so to the audit committee. A deliberate, visible gap is a governance decision; an invisible one is an ambush.
It also helps to separate assurance the function is uniquely placed to give from assurance that already exists elsewhere. Safety and security carry regulator-driven oversight; financial statements carry external audit. Internal audit's scarce hours belong where no other line of defence is looking — which, in most carriers, is the commercial and contractual middle of the business.
Questions for CAEs and audit committees
- Could a director read our audit universe and understand how this airline makes money? If not, what is it actually a map of?
- When did revenue management, interline settlement or route profitability last appear in an audit plan — and if never, who decided that?
- What proportion of planned hours falls on entities that influence operating result, versus entities that influence the control-environment narrative?
- Which top-ten cash flows in the management accounts have no corresponding entity in the universe?
Where to start
Do not begin with a full universe rewrite; begin with a reconciliation. Take the current universe, lay it against the airline's revenue and cost structure, and list every material flow with no assurance owner. That single exhibit — usually producible in weeks — gives the CAE a mandate for change and gives the audit committee its first honest picture of coverage. The rebuilt universe then follows from evidence, not assertion.