The Institute of Internal Auditors defines an internal audit:
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
Internal Audits can take the form of a ten step process, like the one which I found on the Cornell University Audit Office website:
- Notification
- Planning
- Opening Meeting
- Fieldwork
- Communication
- Report Drafting
- Management Response
- Closing Meeting
- Report Distribution
- Follow-up
Notification
The start of the process is a notification to the company, or unit of a company to be audited. In the notification, usually a letter the auditor asks for information. The information the auditor may ask for includes organizational charts, financial statements, and other documents which will let the auditor become familiar with the organization.
Planning
The auditor then determines where risks may exist. They will draft an audit plan, and schedule a meeting.
Opening Meeting
The opening meeting will involve senior staff, and employees involved in the audit. The scope of the audit will be discussed and employees can ask the auditor to extend the scope to cover other areas that they are concerned about. The time frame of the audit, and timing of vacations or other days off is discussed.
Fieldwork
After the meeting the audit plan is finalized and field work will begin. Fieldwork involves talking to staff, reviewing manuals, learning about your processes, and testing for compliance with company policies, procedures, and the law. Internal controls will also be examined.
Communication
Throughout the audit the auditor should communicate with you about issues, and to discuss solutions.
Report Drafting
After the field work the auditor should draft a report which includes the following:
- the distribution list
- the follow-up date
- a general overview of your unit
- the scope of the audit
- any major audit concerns
- the overall conclusion
- detailed commentary describing the findings and recommended solutions
Management Response
After the final report is issued get a response from the managers of the areas audited. Look for whether they agree or not with the findings, and how they intend to implement changes to solve the issues discovered.
Closing Meeting
After the audit and management responses are completed the closing meeting will allow everyone involved to respond to the findings, proposed solutions and if there are any more problems to be discussed.
Report Distribution
The final report is then distributed to everyone involved.
Follow-up
Follow up reviews can be scheduled to check on the progress of correcting issues that were found during the audit.





