Internal Audit Planning and Execution
Comprehensive guide covering audit universe development, risk-based audit planning, fieldwork execution, and reporting best practices.
Internal Audit Methodology
Annual Planning Process
1. Audit Universe
- Identify all auditable entities
- Business units, processes, systems
- Categorize and prioritize
2. Risk Assessment
- Inherent risk factors
- Control environment assessment
- Prior audit results
- Regulatory requirements
3. Audit Plan Development
- Coverage requirements
- Resource allocation
- Timing and scheduling
- Board approval
Audit Engagement Process
Planning Phase
- Send engagement notification
- Hold kickoff meeting
- Gather documentation
- Perform risk assessment
- Develop audit program
Fieldwork Phase
- Execute testing procedures
- Document workpapers
- Identify issues
- Discuss with management
- Validate findings
Reporting Phase
- Draft audit report
- Management response
- Issue rating and escalation
- Final report issuance
- Board reporting
Finding Classification
| Rating | Definition | Remediation | |--------|------------|-------------| | Critical | Immediate threat to organization | 30 days | | High | Significant control weakness | 60 days | | Medium | Moderate improvement needed | 90 days | | Low | Minor enhancement opportunity | 180 days |
Issue Management
- Clear issue statements
- Root cause identification
- Actionable recommendations
- Management action plans
- Validation testing
- Trend reporting
Quality Assurance
- Peer review process
- Methodology compliance
- Professional standards (IIA)
- External quality assessment