On this page
- How we can help
- Focus attention where the risks are
- What the engagement can cover
- Plan the review
- Translate business concerns into testable questions
- Distinguish control design from operation
- Make findings specific enough to act on
- Verify follow-up and preserve accountability
- A practical way forward
- Frequently asked questions
- Related guides and services
- Official sources & further reading
How we can help
- Set objectives and reporting responsibilities before fieldwork.
- Prioritise significant risks and test how controls operate in practice.
- Track agreed actions to an owner and completion date.
Focus attention where the risks are
Internal audit helps management and those charged with governance evaluate how processes and controls operate. A useful review has a defined purpose, clear access to evidence and a reporting route that supports objective findings.
Saif Chartered Accountants can help review operational and financial processes, identify control gaps and agree a risk-based work programme. The scope may focus on a particular function, project or set of risks.
What the engagement can cover
Process walkthroughs; authorisation and segregation-of-duties checks; procurement and payments; sales and collections; inventory and asset controls; financial close procedures; and compliance with agreed internal policies.
Findings should explain the condition observed, the risk, the underlying cause and a practical recommendation. Management responses, action owners and target dates make the report useful after the review finishes.
Plan the review
Identify the process owners, key systems, relevant policies, recent incidents and previous findings. Agree the reporting audience, confidentiality arrangements, sample periods and access to records.
An internal audit does not replace management’s responsibility for controls or an independent financial statement audit. Its value depends on an appropriate scope and follow-through on agreed actions.
Translate business concerns into testable questions
Describe the concern before choosing the sample: duplicate payments, unexplained stock losses or slow collections need different work programmes. Identify the process, systems, people and period involved, then agree what the review should establish. A focused question such as whether supplier changes are authorised is more actionable than an instruction to check all finance operations without an agreed boundary.
The engagement plan should identify the evaluation criteria, information required and reporting route, including any access limitations. The IIA’s current guidance emphasises risk-informed objectives and scope. The practical output is a programme connecting the significant risks to the procedures proposed, so management and the reporting audience understand what the review covers and which questions remain outside it.
Distinguish control design from operation
A written policy can describe a sensible control without demonstrating that staff follow it. Walk through a transaction to understand the intended process, then inspect relevant evidence to assess how the control operated in the period selected. Ask who initiates, approves, records and reconciles the transaction, and consider what happens when the usual approver is absent or an urgent exception is requested.
For a supplier-bank-detail change, the review might follow the request, independent verification, approval and first payment. A missing approval and an approval added after payment are different observations. Document the actual sequence and evidence rather than concluding that a control works because the policy exists. These examples illustrate a possible scope; the appropriate procedures depend on the agreed risks and objectives.
Make findings specific enough to act on
A useful finding explains the expected practice, the condition observed, the supporting evidence and why the difference matters. Establish the likely cause through discussion rather than assuming every exception reflects negligence or fraud. Prioritise the issue in the context of the business and distinguish an isolated processing mistake from a repeated weakness that could affect a wider population of transactions.
Recommendations or management action plans should address the underlying risk and be feasible in the operating environment. Adding another signature may not help if both signatories receive incomplete information. Discuss alternatives and record management’s response, the person responsible and a target date. The report should make disagreements or unresolved limitations visible rather than implying that every recommendation has been accepted.
Verify follow-up and preserve accountability
Agree how completed actions will be evidenced and who will report progress. A statement that a new procedure was issued is different from evidence that the revised control operates. Follow-up can examine the updated process and relevant records in proportion to the issue’s significance. Keep overdue actions and changed risk decisions visible to the agreed management or governance audience.
Internal audit does not take over management’s responsibility to operate controls or implement decisions. The engagement should also address objectivity and reporting arrangements before work begins; the service description alone does not establish conformity with professional standards. Expected outputs can include a scoped review programme, documented findings and an action tracker, with the level of detail and follow-up agreed for the engagement.
YOUR NEXT STEPS
A practical way forward
- 01
Step 1
Define risks, objectives and the review programme.
- 02
Step 2
Walk through the process and test selected controls.
- 03
Step 3
Discuss findings, report recommendations and agree follow-up.
CLEAR ANSWERS
Frequently asked questions
Is internal audit the same as an external audit?
No. Internal audit focuses on the agreed processes, controls and risks. An external financial audit has a different objective and reporting framework.
Can a review cover one department?
Yes. A focused scope can cover a process or function, with its interfaces and limitations documented in advance.
What if a written policy exists but staff do not follow it?
The review can distinguish the design of the policy from evidence of its operation. Findings should describe the actual exceptions and risk, supported by the agreed testing.
How is an agreed action shown as complete?
Define suitable evidence and a follow-up approach. Updating a policy and demonstrating that the revised control works are different milestones; management remains responsible for implementing the action.
VERIFY THE DETAIL
Official sources & further reading
- The IIA — Engagement Planning: Establishing Objectives and Scope, May 2026
- The IIA — Global Internal Audit Standards
- The IIA — Engagement work, findings and follow-up overview
Source checks support this general guide. Your treatment depends on the facts, tax period and applicable legislation.
