• Assessment Techniques

An internal auditor uses assessment techniques to understand how internal control procedures work and whether employees are following internal control directives. Auditors’ indirect assessment techniques, such as reviewing flowcharts, manuals, departmental control policies, or other existing documentation, are used to avoid disrupting daily workflow. Direct discussion with department staff may be necessary if documented procedures are not being followed.

• Analysis Techniques

According to law, auditing fieldwork procedures can include transaction matching, physical inventory count, audit trail calculations, and account reconciliation. An auditor may analyze random data or specific data if he or she believes an internal control process needs to be improved.

• Reporting Procedures

A formal internal audit report may include a preliminary or interim report in the form of a memo. The auditor typically includes sensitive or significant results in an interim report to make the board of directors aware of them as soon as possible. The final report summarizes the procedures and techniques used to complete the audit, describes the audit findings; and makes suggestions for improving internal controls and control procedures. Management reviews the formal report and issues recommendations for improvement. Ensure that the new recommendations have been implemented and have improved operating efficiency by following up after a period of time.

• Planning 

Planned activities include defining the scope and objectives of the audit, reviewing guidance relevant to audit (e.g., laws, regulations, industry standards, company policies, and procedures), reviewing the results of previous audits, creating an audit plan, identifying the process owners, and scheduling a kick-off meeting. 

• Fieldwork 

Auditing is carried out in the field. This phase involves the audit team executing the audit plan. 

As part of this process, the key personnel may be interviewed to confirm they understand the process and controls, relevant documents and artifacts are reviewed, for example, execution of the controls are tested, documentation of the work is provided, and deficiencies and recommendations are identified.

• Reporting 

In the reporting phase, internal auditors are responsible for drafting the audit report. Clarity and conciseness will help avoid misinterpretation and encourage the intended audience to actually read and understand the report. Findings should be accompanied by actionable recommendations that improve processes. In order to release an internal audit report, the first step should be to draft the report, review it with management to ensure accuracy, and then distribute it.

• Follow-up 

Many people overlook and ignore the final stage of a project. In order to address the issues identified, it is critical to follow up on the recommendations. As part of this process, process owners who are responsible for implementing the recommendations should be followed up with, and the Board of Directors should be aware of the company’s overall progress in addressing findings identified by the internal audit. Change is unlikely to occur if an organization does not follow up on the implementation of recommendations.