1Overview — What Is Internal Audit?

Internal Audit (IA) is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Internal audit is not bookkeeping, not a witch-hunt, and not a substitute for management’s own controls. It exists to give leadership honest, evidence-based visibility into whether the organization’s processes actually work the way they’re supposed to.

2Core Principles (The Foundation)

These principles — largely drawn from the IIA’s International Professional Practices Framework (IPPF) — are what every internal auditor is expected to uphold on every engagement.

Supporting concepts

3Internal Audit vs External Audit

This is the single most-asked question for beginners. Both exist to provide assurance, but they differ in who performs them, who they report to, their scope, and their objective.

4Who Conducts What — Models & Bodies

5Why Internal Audit Matters

6Why Internal Audit Is Required

• 📋 Regulatory expectation — many listing rules and corporate governance codes require an internal audit function or equivalent.
• ⚠️ Risk complexity — modern organizations face financial, operational, cyber, and reputational risk that management alone can’t fully self-check.
• 🔍 Fraud deterrence — the presence of an active internal audit function is one of the strongest deterrents to internal fraud.
• 🏗 Process assurance — as organizations scale, controls that worked at a small size need independent verification at large size.
• 📊 Informed decision-making — leadership needs an independent, unbiased source of truth, separate from operational teams reporting on themselves.

7Fraud Detection & Red Flags

Fraud is any act involving deceit, deception, or improper manipulation — typically the unauthorized alteration or misappropriation of money, documents, shares, or equipment for personal gain, carried out through dishonesty in handling property, records, or resources entrusted to someone. Detecting it is one of internal audit’s most important — and most sensitive — responsibilities.

Common types of misappropriation

Red flags auditors look for

• 🚩 Documents or reports that are missing, incomplete, or never filed/published when they were required to be
• 🚩 Round-number or just-below-approval-threshold transactions appearing repeatedly
• 🚩 Same person requesting, approving, and receiving/custodying an asset or payment (no segregation of duties)
• 🚩 Frequent manual overrides of system controls or unusual journal entries near period-end
• 🚩 Asset registers that don’t reconcile with physical counts, or write-offs with no disposal evidence
• 🚩 An employee unusually resistant to taking leave, or unwilling to hand over their process to anyone else
• 🚩 Lifestyle noticeably beyond known income, or sudden reluctance to answer routine questions
• 🚩 Vendors or shareholders with addresses/details matching employee records (related-party concealment)

How fraud is detected

1. Data analytics: run duplicate-payment checks, Benford’s Law tests, and outlier/round-number analysis across transaction populations.
2. Reconciliation: match physical asset counts, share registers, and bank/cash records against the books — gaps are the first signal.
3. Document tracing: follow a transaction from origin to approval to settlement; missing links or altered dates are key indicators.
4. Interviews & observation: inconsistent answers, defensive behavior, or unexplained gaps in explanations often surface during walkthroughs.
5. Whistleblower / tip-off channels: confidential hotlines and ethics lines remain the single most common way fraud is first discovered.
6. Escalation: once indicators are confirmed, internal audit escalates to the Audit Committee / forensic team rather than investigating alone — preserving evidence and independence.

8Surprise Audits

A surprise audit is an unannounced review — no advance notification email, no scheduled kickoff — conducted specifically where advance notice could allow evidence to be altered or hidden. It is closely tied to fraud detection: it is often triggered when someone provides information — a whistleblower tip, an anonymous complaint, an unusual data-analytics alert, or a pattern noticed during routine work.

1. Trigger received: a tip-off, hotline report, or analytics alert is logged confidentially.
2. Preliminary review: a small team quietly validates whether the information is credible enough to act on.
3. Unannounced visit: the audit team arrives without notice, secures relevant records/systems, and begins evidence gathering immediately.
4. Evidence preservation: physical counts, system logs, and documents are captured before anyone has a chance to alter them.
5. Reporting: findings go through an expedited, confidential reporting line — often bypassing the normal draft-report cycle if fraud is confirmed.

9The Internal Audit Lifecycle

1. Planning & Risk Assessment — build the annual audit plan by ranking auditable units against risk (impact × likelihood).
2. Notification & Kickoff — send an engagement notification email/call to the auditee, confirm scope, dates, and required documents.
3. Fieldwork & Testing — walkthroughs, sampling, control testing, interviews, evidence gathering.
4. Draft Report & Discussion — findings are shared with process owners to validate facts and agree on root cause before finalizing.
5. Final Report & Sign-off — the formal report, with agreed management action plans and target dates, goes to the Audit Committee.
6. Follow-up & Closure — auditors verify that corrective actions were actually implemented, then close the finding.

10Risk Assessment — How Priorities Are Set

Not every process can be audited every year. Internal audit uses a risk-based methodology to focus limited resources where they matter most.

Typical assessment inputs

11Preparing the Audit Report

12Roles & Responsibilities (RACI View)

13How to Learn Internal Auditing

14How to Participate in a Real Audit

Whether you are on the auditor side or the auditee side, here’s what active participation looks like in practice.

15How to Prepare the Organization for Internal Audit

Beyond an individual auditee’s checklist (Section 14), a well-run organization prepares itself structurally so that any audit — scheduled or surprise — goes smoothly.

Organization readiness checklist

• All required regulatory/compliance reports are filed and published on time, with proof retained
• Approval matrix is documented, current, and enforced in the system (not just on paper)
• Cash, asset, and share registers are reconciled at least monthly
• Segregation of duties exists for request → approve → custody → record steps
• Whistleblower/ethics hotline is live, confidential, and known to staff
• Prior audit findings are closed with retained evidence, not just marked “done”
• Key documents (contracts, approvals, licenses) are stored centrally and retrievable within hours
• Staff know who the audit SPOC is and what to do when an auditor arrives — announced or not

16Notification, Email & Call — Getting Ready

Most real-world audits begin with a formal notification email and, often, a kickoff call/meeting. Here’s the typical flow and what “ready” looks like at each step.

1. Notification Email (1–2 weeks before) — states audit objective, scope, period covered, proposed dates, and the document/data request list.
2. Confirmation Reply — auditee confirms dates, nominates SPOC, flags any conflicts or access constraints.
3. Document Request List (DRL) — auditee starts collecting the requested evidence (policies, logs, approvals, system extracts) before the visit.
4. Kickoff Call / Opening Meeting — both sides align on scope, timeline, key contacts, and reporting expectations; questions are raised early.
5. Fieldwork Window — auditor conducts interviews, testing, and evidence review on-site or remotely.
6. Closing Meeting — preliminary findings are verbally walked through before the draft report is issued, avoiding surprises.

17Field Checklist — Before, During, After

Before the Audit

• Read the notification email and confirm scope & dates
• Nominate SPOC and share contact details
• Collect documents against the Document Request List
• Brief the team members who will be interviewed

During the Audit

• Attend the opening meeting and clarify scope questions
• Provide evidence promptly; avoid delays that extend fieldwork
• Answer questions factually; escalate anything unclear internally
• Track open queries raised by the auditor

After the Audit

• Review the draft report; validate facts before sign-off
• Agree realistic action owners and target dates
• Implement corrective actions and retain evidence of closure
• Confirm closure with internal audit at follow-up

18Worked Example — End to End

1. Risk Assessment: Vendor payments flagged high-risk due to prior year’s segregation-of-duties gap.
2. Notification: Email sent to Finance Manager (SPOC) with DRL: PO records, approval matrix, payment logs (last 6 months).
3. Kickoff Call: Scope confirmed — sample of 40 payments across 3 categories; fieldwork dates set.
4. Fieldwork: Auditor tests whether each payment has PO, GRN, and dual approval before disbursement. Finds 6 of 40 payments approved by a single person above their authority limit.
5. Draft Finding: Condition: single-approver payments exceeding limit. Cause: system control not enforcing dual sign-off above threshold. Effect: risk of unauthorized/erroneous payment. Recommendation: enforce system-level dual approval.
6. Management Response: Finance agrees to configure ERP approval workflow within 45 days; owner named.
7. Report Issued: Rated “Moderate” risk; sent to Audit Committee.
8. Follow-up: Auditor re-tests after 45 days, confirms system enforces dual approval, closes the finding.