01 Internal Audit Fundamentals

Internal auditing is one of the most important assurance functions inside an organization.

It helps answer questions such as:

Are Our Controls
Designed Properly?

Are They Operating
Effectively?

Are Policies
Being Followed?

Are Risks
Being Managed?

Are Compliance
Requirements Met?

Can Management
Rely on the Controls?

Internal Audit provides an independent and structured way to evaluate whether governance, risk-management, and control processes are working as intended.

A simplified internal-audit lifecycle looks like:

Audit Universe
      ↓
Risk Assessment
      ↓
Audit Planning
      ↓
Scope
      ↓
Evidence Collection
      ↓
Control Testing
      ↓
Findings
      ↓
Management Response
      ↓
Audit Report
      ↓
Remediation
      ↓
Follow-Up

Learning Objectives

By the end of this lesson, you will be able to:

Explain the purpose of Internal Audit.
Understand the difference between auditing and compliance.
Understand independence and objectivity.
Explain assurance and advisory activities.
Understand the three-lines model.
Understand risk-based auditing.
Define audit scope and objectives.
Understand the audit universe.
Understand audit criteria.
Identify control objectives.
Distinguish control design from operating effectiveness.
Understand audit evidence.
Understand control testing.
Understand sampling.
Understand audit findings.
Explain root-cause analysis.
Understand corrective and preventive actions.
Understand audit reporting.
Understand management responses.
Understand remediation tracking.
Explain follow-up auditing.
Understand the role of Internal Audit in GRC.

1. What Is Internal Audit?

Internal Audit is an independent assurance activity that evaluates whether an organization’s:

Governance

Risk Management

Internal Controls

are designed and operating effectively.

Conceptually:

Business Operations
      ↓
Controls
      ↓
Risk Management
      ↓
Internal Audit
      ↓
Independent Assurance
      ↓
Management / Board

2. Why Internal Audit Exists

Organizations operate thousands of controls.

Examples:

Access Reviews

Change Approvals

Vulnerability Scanning

Backup Testing

Firewall Reviews

Vendor Assessments

Security Monitoring

Incident Response

Financial Approvals

Management may believe these controls work.

Internal Audit asks:

Can we independently verify that they work?

3. Internal Audit Is an Assurance Function

Internal Audit provides:

Independent Evaluation

of whether:

Expected Control
=
Actual Control

4. Example

Policy says:

Privileged Access
Must Be Reviewed
Quarterly

Management says:

Access Reviews
Are Performed

Internal Audit tests:

Were Reviews
Actually Performed?

Were All Accounts Included?

Were Reviewers Appropriate?

Were Exceptions Remediated?

5. Internal Audit vs Compliance

These functions overlap but are different.

Compliance

Compliance asks:

Are We Meeting
Required Rules?

Requirements may come from:

Law

Regulation

Contract

Framework

Policy

Standard

Internal Audit

Internal Audit asks:

Are Controls
Designed and Operating
Effectively?

6. Example

PCI DSS requirement:

Access Must
Be Appropriately
Controlled

Compliance may:

Map Requirement
to Control

Internal Audit may:

Test the Control

Inspect Evidence

Sample Accounts

Identify Exceptions

7. Internal Audit vs External Audit

Internal Audit

Performed by:

Internal Audit Function

or co-sourced specialists.

Focus:

Enterprise Risk

Governance

Controls

Operational Improvement

External Audit

Performed by an independent external organization.

Examples:

Financial Statement Audit

SOC Examination

Certification Audit

Regulatory Audit

8. Internal Audit vs Security Assessment

A security assessment may focus specifically on:

Technical Controls

Vulnerabilities

Configurations

Architecture

Internal Audit may evaluate:

Technical
+
Process
+
Governance
+
Evidence

9. Independence

One of the most important internal-audit principles is:

Independence

The auditor should be sufficiently independent from the activity being audited.

Avoid:

Control Owner
      ↓
Audits Own Control

This can create:

Conflict of Interest

10. Objectivity

Objectivity means auditors evaluate evidence without inappropriate:

Bias

Pressure

Personal Interest

Management Influence

11. Independence vs Objectivity

Independence relates to:

Organizational Position

Objectivity relates to:

Auditor Judgment

Both are essential.

12. Assurance

Assurance means providing confidence that something is operating as expected.

Example:

Management Statement:
All Privileged Accounts
Use MFA

Audit testing:

Population:
250 Accounts

Sample:
40 Accounts

Exceptions:
0

Internal Audit may provide assurance that the control appears to operate effectively within the tested scope.

13. Reasonable Assurance

Audits usually do not provide:

Absolute Guarantee

because auditors may use:

Sampling

Defined Scope

Time-Bounded Testing

Instead they generally provide a level of reasonable assurance based on evidence.

14. Advisory Activities

Internal Audit may also perform advisory work.

Examples:

Control Design Review

New System Governance Review

Risk Workshop

Process Improvement

Pre-Implementation Review

However, auditors must preserve independence.

15. The Three Lines Model

A simplified governance model:

First Line
Business / Operations

Second Line
Risk / Compliance / Security

Third Line
Internal Audit

16. First Line

The first line:

Owns Risk

and:

Operates Controls

Examples:

IT

Engineering

Finance

HR

Operations

Business Units

17. Second Line

Second-line functions provide:

Oversight

Standards

Risk Guidance

Monitoring

Challenge

Examples:

GRC

Compliance

Cyber Risk

Privacy

Enterprise Risk

18. Third Line

Internal Audit provides:

Independent Assurance

over both:

First Line

and

Second Line

19. Internal Audit Reporting

Internal Audit commonly reports functionally to:

Audit Committee

or another appropriate governance body.

This helps protect:

Independence

20. Audit Committee

The Audit Committee may oversee:

Internal Audit

Financial Reporting

Risk

External Audit

Major Control Issues

21. Internal Audit Charter

Create:

01 Internal Audit Charter

A charter commonly defines:

Purpose

Authority

Independence

Responsibilities

Access Rights

Reporting Structure

22. Audit Authority

Internal Audit may require access to:

People

Systems

Records

Reports

Contracts

Evidence

Applications

relevant to approved audit work.

23. Audit Universe

The:

Audit Universe

is the complete set of auditable areas within an organization.

Examples:

Identity Management

Cloud Security

Network Security

Incident Response

Vendor Risk

Privacy

Business Continuity

Finance

HR

Application Security

Compliance

24. Build an Audit Universe

Create:

02 Audit Universe Register

Use:

Auditable Area	Owner	Criticality	Risk	Last Audit

25. Audit Universe Example

Enterprise
├── Cybersecurity
│   ├── IAM
│   ├── Vulnerability Management
│   ├── SOC
│   └── Cloud Security
├── Technology
│   ├── Change Management
│   ├── Backup
│   └── Infrastructure
├── Compliance
│   ├── PCI DSS
│   ├── SOC
│   └── Privacy
└── Third Parties
    ├── Vendor Risk
    └── Supplier Security

26. Risk-Based Auditing

Internal Audit does not audit every area equally every year.

Instead:

Enterprise Risk
      ↓
Risk Assessment
      ↓
Audit Priority

27. Why Risk-Based Auditing Matters

Suppose the audit universe contains:

100 Auditable Areas

but audit resources allow:

20 Audits

Prioritization becomes necessary.

28. Audit Risk Factors

Consider:

Business Criticality

Financial Impact

Cyber Risk

Regulatory Exposure

Control Changes

Incident History

Previous Findings

Management Concern

29. Audit Risk Assessment

Create:

03 Audit Risk Assessment

Example:

Area	Impact	Likelihood	Change	Audit Priority
IAM	High	High	High	Critical
Backup	High	Medium	Medium	High
Training	Medium	Low	Low	Medium

30. Annual Audit Plan

Risk assessment feeds:

Annual Audit Plan

A plan may include:

Audit Area

Objective

Quarter

Resources

Estimated Duration

31. Audit Engagement

An individual audit assignment is often called an:

Audit Engagement

Examples:

IAM Audit

Cloud Security Audit

PCI Compliance Audit

Vendor Risk Audit

Incident Response Audit

32. Audit Objective

Every engagement should have a clear:

Audit Objective

Example:

Determine whether privileged-access controls are appropriately designed and operating effectively.

33. Audit Scope

Scope defines:

What Is Included?

Which Systems?

Which Locations?

Which Period?

Which Processes?

34. Scope Example

Audit:
Privileged Access Management

Systems:
AWS
Azure
Active Directory

Period:
January–June

Locations:
Global

35. Scope Boundaries

Also identify:

Out of Scope

Example:

Customer IAM
Not Included

36. Audit Criteria

Audit criteria define what the auditor evaluates against.

Examples:

Company Policy

Security Standard

ISO 27001

PCI DSS

Contract

Procedure

Regulatory Requirement

37. Criteria Example

Control expectation:

Privileged Accounts
Must Use MFA

Source:

Enterprise IAM Standard
Section 8.2

That becomes:

Audit Criteria

38. Audit Scope vs Criteria

Scope:

What Will We Audit?

Criteria:

What Standard
Will We Test Against?

39. Control Objective

A control objective describes:

What risk outcome should the control achieve?

Example:

Prevent Unauthorized
Privileged Access

40. Control Activity

A control activity describes:

How the Objective
Is Achieved

Example:

MFA Required
for Privileged Users

41. Audit Control Matrix

Create:

04 Audit Control Matrix

Use:

Risk	Control Objective	Control	Criteria	Test

42. Example

Risk	Control Objective	Control
Unauthorized access	Prevent unauthorized privileged access	MFA
Excessive access	Ensure minimum permissions	Access review
Orphan accounts	Remove access timely	Offboarding

43. Control Design

Design effectiveness asks:

If the control operates as designed, would it adequately address the risk?

44. Design Example

Policy:

Administrator Access
Must Be Reviewed
Every 12 Months

Risk:

Highly Privileged
Production Accounts

Audit may determine:

Annual Review
Is Not Frequent Enough

Therefore:

Design Deficiency

even if the annual review happens perfectly.

45. Operating Effectiveness

Operating effectiveness asks:

Is the control actually operating as designed?

Example:

Control design:

Quarterly Access Review

Evidence:

Q1 Completed
Q2 Not Completed
Q3 Completed
Q4 Completed

Potential:

Operating Effectiveness
Exception

46. Design vs Operating Effectiveness

Control Requirement
      ↓
Design Effective?
      │
      ├── No → Design Finding
      │
      └── Yes
             ↓
      Operating Effectively?
             │
        ┌────┴────┐
       No         Yes
       ↓           ↓
Operating Finding Pass

47. Key Controls

Not every control has equal importance.

Key Control

is especially important in reducing material risk.

Examples:

MFA

Financial Approval

Production Change Approval

Backup Restoration

Vendor Risk Approval

48. Preventive Controls

Prevent events before they occur.

Examples:

MFA

Firewall

Approval Workflow

Segregation of Duties

49. Detective Controls

Detect events after or while they occur.

Examples:

SIEM Alert

Access Review

Reconciliation

Log Review

50. Corrective Controls

Reduce impact after an event.

Examples:

Incident Response

Backup Restoration

Account Disablement

Patch Deployment

51. Manual Controls

Performed by people.

Example:

Manager Reviews
Quarterly Access List

52. Automated Controls

Performed by technology.

Example:

IAM Automatically
Disables Accounts
after 90 Days

53. IT-Dependent Manual Controls

A person performs the control using system-generated information.

Example:

Manager Reviews
IAM Access Report

The auditor may need to validate:

Report Completeness

Report Accuracy

54. Audit Evidence

Evidence supports audit conclusions.

Common evidence includes:

Policies

Procedures

Screenshots

System Reports

Logs

Tickets

Configurations

Contracts

Meeting Records

Interviews

55. Evidence Characteristics

Strong evidence should be:

Relevant

Reliable

Sufficient

Appropriate

Traceable

56. Relevant Evidence

Evidence must relate to:

Control Being Tested

57. Reliable Evidence

Generally stronger:

System-Generated Evidence

than:

Unverified Verbal Statement

depending on context.

58. Sufficient Evidence

The auditor must gather enough evidence to support a conclusion.

One example may not be enough to conclude:

Control Operates
for Entire Population

59. Evidence Hierarchy

Conceptually:

Verbal Statement
      ↓
Document
      ↓
System Report
      ↓
Configuration
      ↓
Independent Verification

The exact strength depends on the control.

60. Audit Evidence Register

Create:

05 Audit Evidence Register

Use:

Evidence ID	Control	Source	Period	Received	Validated

61. Evidence Identification

Use:

AE-001

AE-002

AE-003

to maintain traceability.

62. Evidence Request

A strong evidence request specifies:

What?

Which Period?

Which System?

Which Population?

Which Format?

63. Weak Evidence Request

Please Send
Access Evidence

64. Strong Evidence Request

Provide the complete
population of privileged
AWS IAM users and roles
active from January 1
through March 31.

65. Audit Interviews

Interviews help auditors understand:

Process

Control Design

Responsibilities

Exceptions

System Behavior

But interview statements should often be corroborated.

66. Walkthrough

A walkthrough follows a transaction or process from beginning to end.

Example:

Access Request
      ↓
Manager Approval
      ↓
IAM Provisioning
      ↓
System Access
      ↓
Logging

67. Why Walkthroughs Matter

Walkthroughs help determine:

How the Process
Actually Works

rather than relying only on:

Written Procedure

68. Control Testing

Testing determines whether controls are:

Designed Correctly

Operating Effectively

69. Common Testing Methods

Auditors may use:

Inquiry

Inspection

Observation

Reperformance

Data Analysis

70. Inquiry

Ask responsible personnel:

How Does
the Control Work?

Inquiry alone usually provides weaker evidence.

71. Inspection

Review:

Documents

Tickets

Logs

Reports

Configurations

72. Observation

Watch control execution.

Example:

Observe
Backup Restore
Process

73. Reperformance

The auditor independently performs:

Control Procedure

or recalculation.

Example:

Recalculate
User Access
Exception Count

74. Data Analytics

Auditors may analyze entire populations.

Examples:

All User Accounts

All Firewall Rules

All Vendor Records

All Changes

This can reduce reliance on small samples.

75. Population

The:

Population

is the complete set of items relevant to the control.

Example:

All Production
Changes During 2026

76. Sampling

When testing all items is impractical, auditors may select a:

Sample

Example:

Population:
5,000 Changes

Sample:
60 Changes

77. Sampling Risk

Because only part of the population is tested:

Sample Result

may not perfectly represent:

Entire Population

78. Sample Selection

Methods may include:

Random

Systematic

Judgmental

Risk-Based

depending on methodology.

79. Audit Test Sheet

Create:

06 Audit Test Sheet

Use:

Sample	Control	Criteria	Evidence	Result	Exception

80. Pass

A sample passes when:

Control Meets Criteria

81. Exception

An exception occurs when:

Expected Control
≠
Observed Control

82. Example

Control:

All Terminated Users
Disabled Within 24 Hours

Sample:

30 Terminations

Results:

28 Disabled Within 24 Hours

2 Disabled After 5 Days

Exceptions:

83. Exception Does Not Automatically Equal Finding

Auditors should determine:

Frequency

Cause

Impact

Population Exposure

Compensating Controls

before finalizing a finding.

84. Expand Testing

If exceptions appear, the auditor may:

Increase Sample

Analyze Entire Population

Perform Additional Interviews

85. Audit Finding

A strong audit finding usually includes:

Condition

Criteria

Cause

Effect / Risk

Recommendation

86. Condition

What was observed?

Example:

3 of 30
Terminated Accounts
Were Disabled
More Than 24 Hours
After Termination

87. Criteria

What should have happened?

Example:

IAM Standard Requires
Termination Access
to Be Removed
Within 24 Hours

88. Cause

Why did the issue occur?

Example:

HR Termination Feed
Failed to Send
Notifications to IAM

89. Effect

What risk results?

Example:

Former Employees
May Retain
Unauthorized Access

90. Recommendation

What should management improve?

Example:

Implement Automated
Termination Integration
and Exception Monitoring

91. Findings Register

Create:

07 Audit Findings Register

Use:

ID	Finding	Severity	Owner	Due	Status

92. Finding Severity

Organizations may use:

Critical

High

Medium

Low

or other rating models.

93. Severity Factors

Consider:

Business Impact

Likelihood

Control Importance

Regulatory Exposure

Population Size

Duration

Compensating Controls

94. Root Cause

Strong auditing looks beyond:

What Failed?

to:

Why Did It Fail?

95. Root Cause Example

Finding:

Access Reviews
Were Not Completed

Why?

Managers Did Not
Complete Reviews

Why?

No Escalation Process

Why?

Access Review Workflow
Does Not Track
Overdue Reviewers

Root cause:

Insufficient Governance
and Escalation

96. Correction vs Corrective Action

Correction

Fix the immediate issue.

Example:

Complete
Outstanding Review

Corrective Action

Prevent recurrence.

Example:

Implement Automated
Review Escalation

97. Preventive Action

Prevent similar issues elsewhere.

Example:

Deploy the Same
Automated Review Workflow
Across All Applications

98. CAPA

Organizations may use:

Corrective and
Preventive Action

or:

CAPA

to manage systemic remediation.

99. Management Response

Management should respond to findings with:

Agreement / Disagreement

Corrective Action

Owner

Target Date

100. Auditor vs Management Responsibilities

Auditor:

Identifies Risk
and Recommends Improvement

Management:

Owns Remediation

101. Auditor Should Not Own Remediation

Avoid:

Auditor
Designs
+
Implements
+
Tests
Same Control

because independence can be impaired.

102. Audit Report

The audit report communicates:

Objective

Scope

Conclusion

Findings

Risk

Management Response

103. Audit Report Structure

Create:

08 Internal Audit Report Template

Suggested sections:

Executive Summary

Audit Objective

Scope

Methodology

Overall Conclusion

Key Findings

Detailed Findings

Management Responses

Action Plan

104. Executive Summary

Executives should understand:

What Was Audited?

What Was Found?

How Serious?

What Needs Attention?

105. Overall Audit Rating

Organizations may use ratings such as:

Effective

Generally Effective

Needs Improvement

Ineffective

or another approved model.

106. Avoid Unsupported Ratings

Overall rating should be traceable to:

Testing Results

Findings

Severity

Control Coverage

107. Draft Report

Audit often produces:

Draft Report

for management review.

108. Management Validation

Management may identify:

Factual Errors

Missing Context

New Evidence

The auditor should evaluate this objectively.

109. Auditor Independence During Challenge

Management disagreement does not automatically mean:

Remove Finding

Auditor should ask:

Does New Evidence
Change the Conclusion?

110. Final Audit Report

After factual validation and management responses:

Draft
      ↓
Review
      ↓
Final

111. Report Distribution

Distribution may include:

Process Owner

Business Leadership

Risk

Security Leadership

Audit Committee

depending on severity and governance.

112. Remediation Tracking

Audit findings should not disappear after report issuance.

Track:

Finding

Owner

Action

Due Date

Status

Evidence

Validation

113. Finding Status

Use:

Open

In Progress

Pending Validation

Closed

Risk Accepted

114. Overdue Finding

When:

Current Date
>
Target Date

and remediation is incomplete:

Finding
=
Overdue

115. Finding Aging

Track:

0–30 Days

31–60 Days

61–90 Days

90+ Days

116. Escalation

Example:

High Finding
Past Due
      ↓
Process Owner
      ↓
Executive Owner
      ↓
Audit Leadership
      ↓
Audit Committee

depending on governance.

117. Remediation Evidence

Possible evidence:

Updated Policy

Configuration

Ticket

System Report

Reperformance

Independent Test

118. Closure Validation

Do not close a finding because management says:

Fixed

Audit should verify:

Action Completed?

Control Effective?

Risk Addressed?

119. Follow-Up Audit

A follow-up may verify:

Findings Remediated?

Controls Sustainable?

New Issues Introduced?

120. Risk Acceptance

Management may accept certain risks.

Audit should determine whether:

Correct Authority?

Documented?

Time-Bound?

Within Risk Appetite?

121. Internal Audit Does Not Accept Business Risk

Audit may:

Challenge

Report

Escalate

but the appropriate business or risk authority:

Accepts Risk

122. Audit Trail

Every audit should maintain traceability from:

Risk
      ↓
Control
      ↓
Test
      ↓
Evidence
      ↓
Result
      ↓
Finding
      ↓
Report

123. Audit Working Papers

Working papers support the audit conclusion.

Examples:

Planning Documents

Risk Assessment

Control Matrix

Evidence

Test Sheets

Samples

Interview Notes

Findings

Review Notes

124. Working Paper Structure

Create:

Internal-Audit/
│
├── 01 Planning/
├── 02 Scope/
├── 03 Risk Assessment/
├── 04 Control Matrix/
├── 05 Evidence/
├── 06 Testing/
├── 07 Findings/
├── 08 Management Response/
├── 09 Report/
└── 10 Follow-Up/

125. Working Paper Quality

A reviewer should be able to determine:

What Was Tested?

How?

Using What Evidence?

What Was the Result?

Why Did Auditor
Reach Conclusion?

126. Audit Documentation Principle

A useful mindset:

If the audit work is not documented, it may be difficult to demonstrate that it was performed.

127. Audit Quality Assurance

Audit work may be reviewed by:

Senior Auditor

Audit Manager

Quality Assurance

128. Reviewer Questions

Review:

Was Scope Appropriate?

Was Evidence Sufficient?

Was Testing Complete?

Are Findings Supported?

Is Severity Reasonable?

Are Conclusions Traceable?

129. Professional Skepticism

Auditors should maintain:

Professional Skepticism

Meaning:

Trust
but
Verify

Do not assume:

Policy Exists
=
Control Works

130. Example — MFA Audit

Criteria:

100%
Privileged Accounts
Must Use MFA

Population:

250 Accounts

Testing identifies:

243 MFA Enabled

7 Without MFA

Coverage:

243
─── × 100
250

= 97.2%

Potential finding:

Seven privileged accounts were not protected by required multi-factor authentication.

131. Example — Access Review Audit

Control:

Quarterly Review

Expected:

4 Reviews

Performed:

Operating effectiveness:

Ineffective /
Partially Effective

depending on methodology.

132. Example — Backup Audit

Control:

Monthly Restore Test

Evidence:

12 Months Required

7 Tests Completed

Potential finding:

Recovery Capability
Not Consistently Validated

133. Example — Vendor Risk Audit

Policy:

All Tier 1 Vendors
Require Annual
Risk Assessment

Population:

40 Tier 1 Vendors

Current assessment:

Coverage:

85%

Finding:

6 Critical Vendors
Without Current
Risk Assessment

134. Example — Privacy Audit

Policy:

Personal Data
Must Be Deleted
After Retention Period

Testing identifies:

Expired Records
Still Stored

Potential:

Privacy
and Compliance Risk

135. Example — Cloud Audit

Requirement:

Cloud Audit Logs
Must Be Enabled

Population:

100 Cloud Accounts

Result:

95 Enabled

5 Disabled

Finding:

Security Activity
May Not Be
Fully Traceable

136. Internal Audit Metrics

Internal Audit may track:

Audit Plan Completion

Audit Cycle Time

Finding Closure

Overdue Findings

Repeat Findings

Management Acceptance

137. KPI — Audit Plan Completion

Audits Completed
──────────────── × 100
Audits Planned

138. KPI — Finding Closure

Findings Closed
Within Due Date
──────────────── × 100
Findings Due

139. KRI — Overdue High Findings

High / Critical
Audit Findings
Past Due

140. KRI — Repeat Findings

Audit Findings
Repeated Across
Multiple Audit Cycles

141. Audit Dashboard

Create:

09 Internal Audit Dashboard

Example:

Metric	Target
Audit plan completion	100%
High findings overdue	0
Critical findings open	0
Repeat findings	0
Remediation within SLA	100%

142. Common Internal Audit Mistakes

Mistake 1 — Auditing Without Defined Criteria

Without criteria, conclusions become subjective.

Mistake 2 — Scope Too Broad

An audit trying to cover everything may test nothing deeply.

Mistake 3 — Relying Only on Interviews

People can describe how a control should work rather than how it actually works.

Mistake 4 — Policies Equal Evidence

A policy demonstrates design expectations, not necessarily operation.

Mistake 5 — No Population Validation

A sample is unreliable if the underlying population is incomplete.

Mistake 6 — Finding Based on One Exception Without Analysis

Understand frequency, cause, and impact.

Mistake 7 — No Root Cause

Fixing symptoms may allow the issue to return.

Mistake 8 — Auditor Owns Remediation

This can impair independence.

Mistake 9 — Closing Findings Without Validation

Management completion is not the same as verified remediation.

Mistake 10 — Weak Working Papers

Unsupported conclusions are difficult to defend.

Mistake 11 — Severity Inflation

Not every exception is Critical or High.

Mistake 12 — Reporting Detail Without Business Impact

Executives need to understand why a finding matters.

143. Weak Internal Audit

Ask Questions
      ↓
Collect Documents
      ↓
Find Problems
      ↓
Write Report

144. Strong Internal Audit

Audit Universe
      ↓
Risk Assessment
      ↓
Audit Plan
      ↓
Objective
      ↓
Scope
      ↓
Criteria
      ↓
Control Matrix
      ↓
Evidence
      ↓
Testing
      ↓
Exceptions
      ↓
Root Cause
      ↓
Findings
      ↓
Management Response
      ↓
Report
      ↓
Remediation
      ↓
Validation
      ↓
Follow-Up

145. GRC Analyst and Internal Audit

GRC and Internal Audit frequently work together.

GRC may:

Define Controls

Maintain Risk Registers

Coordinate Compliance

Collect Evidence

Track Findings

Internal Audit may:

Independently Test

Challenge

Validate

Report

146. Internal Audit and Compliance Relationship

Compliance
      ↓
Requirements
      ↓
Controls
      ↓
Evidence
      ↓
Internal Audit
      ↓
Independent Testing

147. Internal Audit Mindset

For every control ask:

What Risk
Does This Control
Address?

What Should
the Control Do?

What Criteria
Requires It?

Who Owns It?

How Often
Should It Operate?

What Is the
Population?

What Evidence
Proves It Operated?

Is the Control
Designed Properly?

Did It Actually
Operate?

How Many
Exceptions Exist?

Are Exceptions
Isolated or Systemic?

Why Did
They Occur?

What Risk
Do They Create?

Is the Finding
Supported by Evidence?

Who Owns
Remediation?

When Is It Due?

How Will We
Validate Closure?

Can Another Auditor
Reperform Our Work
Using the Documentation?

That is the practical mindset behind Internal Audit.

Key Takeaways

Internal Audit provides independent assurance over governance, risk management, and controls.
Independence and objectivity are fundamental audit principles.
Compliance determines whether requirements are met; Internal Audit independently tests whether controls actually work.
Internal Audit commonly operates as the third line within enterprise governance.
Risk-based auditing prioritizes audit resources according to enterprise risk.
The audit universe identifies the organization’s auditable areas.
Every audit should define objectives, scope, and criteria.
Control objectives describe desired risk outcomes.
Control design and operating effectiveness must be evaluated separately.
Audit evidence should be relevant, reliable, sufficient, and traceable.
Walkthroughs help auditors understand how processes really operate.
Testing may use inquiry, inspection, observation, reperformance, and data analytics.
Sampling should be based on a defined and complete population.
Exceptions should be analyzed before becoming findings.
Strong findings describe condition, criteria, cause, effect, and recommendation.
Root-cause analysis helps prevent repeated issues.
Management owns remediation; auditors independently validate it.
Findings should remain tracked until closure is verified.
Follow-up auditing confirms whether corrective actions are sustainable.
Working papers provide evidence supporting audit conclusions.
Audit reports should communicate material risk and required action clearly.
GRC and Internal Audit work closely but must maintain appropriate independence.

Knowledge Check

Before continuing, make sure you can answer:

What is Internal Audit?
Why does Internal Audit exist?
What is the difference between auditing and compliance?
What is the difference between Internal Audit and External Audit?
Why is auditor independence important?
What is auditor objectivity?
What is assurance?
What is the three-lines model?
What does the first line do?
What does the second line do?
What does the third line do?
What is an Internal Audit Charter?
What is an audit universe?
What is risk-based auditing?
What is an audit objective?
What is audit scope?
What are audit criteria?
What is a control objective?
What is design effectiveness?
What is operating effectiveness?
What is audit evidence?
What makes evidence reliable and sufficient?
What is a walkthrough?
What are the common control-testing methods?
What is an audit population?
Why is sampling used?
What is an audit exception?
What makes a strong audit finding?
What is root-cause analysis?
Why must remediation be independently validated?

What’s Next?

➡️ Next: 02 — Audit Planning

In the next lesson, you will move from Internal Audit fundamentals into designing and preparing a complete audit engagement.

You will work through:

Audit Universe
      ↓
Risk Assessment
      ↓
Audit Selection
      ↓
Background Research
      ↓
Audit Objective
      ↓
Scope
      ↓
Criteria
      ↓
Risk & Control Analysis
      ↓
Audit Program
      ↓
Resource Planning
      ↓
Stakeholder Communication
      ↓
Fieldwork Readiness

You will learn how to build an Annual Audit Plan, Audit Engagement Planning Memo, Risk Assessment, Audit Scope Statement, Audit Control Matrix, Audit Program, Evidence Request List, Stakeholder Communication Plan, Audit Timeline, and Planning Checklist.

This will prepare you to move from understanding what Internal Audit is to actually planning and executing a professional audit engagement.