Internal Audit Process and Methodology
The engagement lifecycle
Every audit follows a recognizable arc: risk-based annual planning, engagement-level risk assessment, planning memo, fieldwork, workpapers, findings, reporting, and follow-up. Candidates should be able to sequence these steps and identify which activity belongs where. Traps frequently place reporting before management's response, or place follow-up inside fieldwork.
Planning and risk assessment
Engagement planning defines objectives, scope, and criteria. A common exam trap: an auditor who expands scope mid-engagement without updating the plan or notifying the client. Scope changes are permissible but must be documented and approved.
Evidence and sampling
Evidence must be sufficient, reliable, relevant, and useful. Third-party confirmations outrank internal memos; observation beats inquiry alone. Sampling questions test whether the candidate understands that statistical sampling allows projection to the population while judgmental sampling does not. Watch for questions that ask for the most persuasive evidence, not merely adequate evidence.
Findings and reporting
A well-formed finding has five elements: criteria, condition, cause, effect, and recommendation. Questions often supply four and ask what is missing. Reports should be objective, clear, concise, constructive, and timely-and should be issued even when management disagrees, with the disagreement documented.
Worked example
You find 12 of 60 sampled wires lacked documented callbacks. Rule of thumb: state the criteria (policy requires callback), the condition (12 exceptions), the cause (no supervisory review), the effect (potential unauthorized transfers), then recommend a second-level review.
Follow-up
Follow-up verifies remediation and escalates unresolved high-risk issues to the audit committee.