What Is Internal Auditing? (With Step-by-Step Guide)

By Indeed Editorial Team

Updated 11 December 2022

Published 15 November 2021

The Indeed Editorial Team comprises a diverse and talented team of writers, researchers and subject matter experts equipped with Indeed's data and insights to deliver useful tips to help guide your career journey.

An audit is a thorough examination of a business's processes. Internal auditing is a process that can help you keep a business accountable. The most effective internal audits follow proven strategies. In this article, we explain what internal auditing is, who performs this role and how to conduct internal audits, with tips for effective internal auditing.

What is internal auditing?

Internal auditing is the process of assessing a business' internal processes. Internal auditing makes sure a business's processes are consistent with its policies. It also helps businesses discover process gaps and areas for improvement. Regular internal auditing helps businesses to meet relevant policies and maintain a high-quality output. Regular internal auditing is part of the performance evaluation for all International Organisation Standardisation (ISO) management system standards.

Who performs internal audits?

Internal audits are usually conducted by one or more of a business's employees. But it is often the accountant who handles internal audits. Businesses may also involve other employees who are trained in internal auditing.

Businesses with insufficient resources for managing internal audits may outsource their auditing to a third-party service. While these services are external to the business, they are not considered to be external auditors because they are acting on behalf of the business, rather than on behalf of an external organisation, e.g. shareholders or the Australian Tax Office.

Related: How to Become an Accountant: A Comprehensive Guide

How to conduct an internal audit

Following a consistent process helps internal auditing to run smoothly. Businesses repeat this process at regular intervals to monitor internal processes over time. Here are the common steps for conducting an internal audit:

1. Identify internal auditing targets and scope

Identify the processes you want to audit and the objectives of your internal audits. Consider the nature of each process and the potential risks it poses to the business and its customers. Choose processes that are high risk or that can help the business grow.

For example, you may audit financial processes to confirm that the business spends money in the right places. Understanding which processes are relevant to internal auditing and why you're auditing them gives your internal audits the best chance of benefiting the business.

Related: How to Write a Project Scope Document

2. Create an internal audit schedule

Conducting regular internal audits helps the business monitor its progress over time. Scheduling internal audits can help you to ensure that the process is repeated at consistent intervals and minimise the risk of clashes with other business processes. Publicising the internal audit schedule provides advance notice to others in the company that an audit is approaching. Departments can then prepare the relevant records and documentation in advance. Employees can also schedule time for internal auditing duties. The business may perform internal audits every week, every month, every six months, every year or choose another interval. Many businesses audit a couple of processes every few months. This approach keeps each internal audit manageable.

Think about the complexity of your processes, the risk of inconsistencies and the availability of auditing resources to help you plan a suitable schedule. Businesses with complex processes that pose a high risk usually perform internal audits more often than businesses with simple, low-risk processes. The processes in some departments may carry a higher risk than others. Businesses may internally audit these departments more often than their low-risk counterparts. Companies with ample resources may audit more frequently than businesses with fewer resources.

3. Plan the internal audit

Take time before each internal audit to plan the process. Thorough planning helps to ensure that an internal audit runs smoothly. The amount of planning time depends on the complexity and size of your internal audit. Plan to allocate more time auditing more complex, high-risk processes. You may like to create an audit checklist. Ticking each task off as you go will help to ensure that your internal audit is thorough and complete.

Review the processes and policies you are auditing so that you understand them. Conduct additional research or ask relevant employees to clarify anything that's unclear to you. Determine the relevant evidence and start sourcing documents so that you can use your auditing time more efficiently. Send your audit plan to the audited departments so they can familiarise themselves with the audit's scope, goals, criteria and required documents. Ask the department's manager if there are any other areas that they would like to include in the audit.

Related: What are Strategic Plans? Definition, Method and Examples

4. Conduct the internal audit

Conduct the internal audit using your preferred method or a combination of auditing techniques. Review evidence with an open mind to ensure that your audit will be fair and unbiased. Here are some common internal auditing techniques:

  • Review documents to check that they respect business procedures

  • Interview relevant employees about their processes

  • Observe employees and assess their compliance with processes

5. Record your findings

Record your findings so that you can analyse the results. Your records may include concrete data, observations and notes taken during the auditing process. Summarise your findings so the representatives of audited departments can see at a glance what you've found. Hand out your records to representatives of audited departments and let them ask questions before you write your final report.

6. Report your findings

Write a report that shows the findings of your internal audit and what you've learned from them. Identify gaps in compliance and areas where the business excels. You can include a corrective action plan that suggests process improvements and internal controls that could reduce compliance gaps. Use plain language that's easy to understand for people working in the business and other stakeholders. Maintain your objectivity to ensure that your report is fair to the business and its employees.

Submit your reports as soon as the internal audit process has been completed. Ask departmental and business managers to review and approve your report. Approved reports become evidence of the internal auditing process.

Related: How to Write Effective Reports in the Workplace

Tips for effective internal auditing

Following best practices helps make internal auditing an effective process that businesses can learn and improve from. Here are some tips that can make you a more effective internal auditor:

Undertake formal internal auditing training

Internal auditing is a complex process. Many people benefit from formal internal auditing training, which teaches them more about this process and best practices. The Graduate Certificate in Internal Auditing (available through the Institute of Internal Auditors Australia) is one of the most highly regarded programs in the country. Refresher training courses can help experienced internal auditors understand new regulatory changes and risk areas. Many independent education providers also offer internal auditor training. Businesses may also set up mentorship programs in which experienced internal auditors coach new auditors.

Revise the audit schedule periodically

Many businesses set their internal audit schedule and maintain it throughout the lifetime of the business. However, it's better to revise the schedule periodically to account for new risks, business processes and available resources. You might revise the audit schedule every few years or whenever the business undergoes substantial changes.

Choose impartial auditors

To keep internal audits as fair and balanced as possible, do not choose auditors from the department you're auditing. For example, if you're auditing the finance department, you might choose an internal auditor from the marketing department. Training internal auditors from various departments will allow you to have several suitable employees to choose from when auditing time arrives.

Collaborate with the audited departments

The most successful internal audits are collaborative efforts, rather than processes imposed on a department. Remind audited departments about when their audit is scheduled so that they can start preparing in advance. Meet with employees from all functional areas at the start of the audit process and listen to their concerns about the way their department is run. Be transparent throughout the auditing process and answer any questions from employees. Conclude the auditing process with a review meeting before you distribute the final report.

Related: Factors That Define Auditing In the Financial Industry

Look to the future

While internal audits record what has happened in the past, they exist to make businesses better. It's recommended that your audit focuses on the future and any learning opportunities for the business.

Track results

When internal auditing is successful, businesses improve over time. They help to close performance gaps and align processes with policies. Recommendations from the audit are used to formulate corrective action plans and improve business protocols. By tracking business results over time, it becomes apparent whether internal auditing processes are effective.

A good way to do this is by creating a spreadsheet with corrective action plans and due dates for their implementation. Make this spreadsheet public so that all the employees can understand the business's objectives and work towards them. As due dates approach, track progress and take any necessary steps to reach the goals on time.

Please note that none of the companies mentioned in this article are affiliated with Indeed.

Explore more articles