Audit Plan

I am the first Internal Auditor here at Valley and I am attempting to put the program itself together.  It is my understanding than an Audit Plan is created and presented to the Supervisory Committee each year for review/approval.  We have developed and established the position itself and an Audit Charter that has been approved by the Supervisory Committe, and accepted by the Board.  My understanding is that we now need to establish risk assessments and an audit plan based off of those assessments.  I am just attempting to see if I am on the right track.  Any assistance/guidance would be greatly appreciated.  Thank you!