Steps of the internal audit activity

Based on a risk assessment of the organization, internal auditors, management and oversight Boards determine where to focus internal auditing efforts. Internal auditing activity is generally conducted as one or more discrete projects. A typical internal audit project involves the following steps:

1. Establish and communicate the scope and objectives for the audit to appropriate management.
2. Develop an understanding of the business area under review. This includes objectives, measurements, and key transaction types. This involves review of documents and interviews. Flowcharts and narratives may be created if necessary.
3. Describe the key risks facing the business activities within the scope of the audit.
4. Identify control procedures used to ensure each key risk and transaction type is properly controlled and monitored.
5. Develop and execute a risk-based sampling and testing approach to determine whether the most important controls are operating as intended.
6. Report problems identified and negotiate action plans with management to address the problems.
7. Follow-up on reported findings at appropriate intervals. Internal audit departments maintain a follow-up database for this purpose.

Project length varies based on the complexity of the activity being audited and Internal Audit resources available. Many of the above steps are iterative and may not all occur in the sequence indicated. By analyzing and recommending business improvements in critical areas, auditors help the organization meet its objectives. In addition to assessing business processes, specialists called Information Technology (IT) Auditors review information technology controls.