What does an internal audit review entail?

There are essentially five key stages involved in an internal audit review.

1. Getting started

It’s important to be clear what your review objectives are, what sort of review you need and what the review approach should be.  We’ll discuss these with the Audit Committee Chair and Head of Internal Audit at the outset.

We’ll agree which of Internal Audit’s stakeholder’s views we will get and what documents we’ll need to review.  We’ll also agree a timetable with you, including reporting deadlines and protocols, and organise the administrative logistics.  The key aspects, including our fee, will be set out in our engagement letter.

Before we get going, we’ll spend some time with you to get briefed on internal audit’s recent progress and the challenges internal audit faces to ensure we focus on the key issues.

2. Information review

We’ll review key audit documentation – methodology, plans, reports and working papers – to assess the quality of Internal Audit’s work.  This review will be undertaken in discussion with audit team members responsible for the work which will help us understand how judgements have been applied.

The information we review will help inform our interviews with internal audit’s key stakeholders.

3. Getting views

We will have one-to-one confidential meetings with Internal Audit’s key stakeholders – typically, audit committee members, executives, as well as managers and process owners whose departments or teams have been subject to  audit.  (We will, of course, also spend time with members of the internal audit team.)  These interviews are the basis of an assessment of the impact made by Internal Audit, and whether it meets expectations.

In advance of the meetings, we’ll send out tailored agendas to get people thinking.  Our interviews are engaging and conversational, and they focus on what concerns those we meet most of all.  We don’t rigidly follow a set of predefined questions but allow the conversation to guide us.  Our focus is on questioning and listening.

4. Analysis and reporting

At the conclusion of our field work – information review and interviews – we’ll analyse what we have found taking into account good practice we have observed in other internal audit reviews we have undertaken.  We’ll then follow up any matters as required.  After our analysis, we’ll discuss key findings with the Head of internal Audit initially (to confirm factual accuracy), and then with the Audit Committee Chair (and, if appropriate, the executive to whom the Head of Internal Audit reports).  Once finalised, we’d be pleased to present our report to the Audit Committee and to feed back to the internal audit team.