The internal audit process

While every internal audit is unique, the process of internal auditing is similar for most engagements and normally consists of four stages. The process described below briefly explains what happens during each stage and outlines the questions and actions the internal auditor needs to address for completion.
1. Research

Before internal auditors begin, they gather a broad range of information about the subject area or activity they are about to review.

• What are the objectives?
• What activities occur?
• How are they performed?
• How is performance measured?
• What are the risks (current, emerging, horizon)?
• What are the responses to risks?
• How do managers know responses to risks are effective?

2. Planning

Auditors use their analysis of the information to determine and agree the scope and objectives of the audit with the audit manager and managers in the organisation.

• Determine the scope of the audit
• Establish and agree audit objectives and the criteria to be sued
• Obtain resources with appropriate skills, knowledge and experience
• Set targets, outputs and deadlines
• Timetable and schedule events
• Prepare programme of work

3. Providing assurance

Internal auditors will tell people how well things are working, based on observations and other information they have collected.

• Gather information through discussion, interviews, observations and other internal audit tests
• Analyse and evaluate information against criteria
• Document/evidence findings
• Draw conclusions and form opinions
• Communicate results

4. Action

Based on the work that internal auditors do, managers acknowledge the risks of what they do and report that up the line or agree to implement improvements. The internal audit is not over until the reporting of the changes takes place.

• Agree with managers what actions they will take
• Clear responsibility and target dates are set
• Ensure process to follow up actions is in place