Introduction
An internal audit is more than checking whether procedures and documents are in place. Auditors look for objective evidence that requirements are understood, processes are being followed, and controls are working as intended.
So, what do auditors actually look for during an audit?
They typically examine the evidence, records, actual practices, employee understanding, risks and controls, and previous corrective actions relevant to the audit criteria. Understanding these areas can help organisations prepare more effectively and identify gaps before they become audit findings. In this article, we look at the key things auditors actually check, the evidence they may request, and the questions they may ask duringan audit.
What Auditors Actually Look For
Auditors look beyond documents and procedures. They examine whether requirements are understood, processes are followed and controls are working effectively in practice.
Compliance With Applicable Requirements
Auditors check whether the organisation is meeting the requirements
that apply to its processes, activities and operations.
Are Processes Actually Being Followed?
Auditors compare documented procedures with actual working practices
to determine whether employees are following the established process.
Effectiveness of Controls
Auditors look at whether established controls are working effectively
and whether there is evidence that they are being applied.
Objective Evidence
Auditors look for records, reports, approvals, inspection results and
other evidence that demonstrates what actually happened.
Records & Documented Information
Records may be reviewed to determine whether activities were properly
performed, recorded and maintained as required.
Corrective Actions & Follow-Up
Auditors may review previous findings to check whether corrective
actions were implemented and appropriately followed up.
What Evidence Do Auditors Usually Check?
Auditors may review different types of evidence to confirm that processes
are being followed, controlled and properly documented.
✓
Procedures & Work Instructions
Auditors may check whether relevant procedures and work instructions
are available, current and consistent with actual working practices.
✓
Completed Forms & Records
Completed records may be reviewed to verify that required activities,
checks, approvals or other process steps were carried out.
✓
Training & Competency Records
Auditors may check training records and other evidence related to
employee competency for relevant roles and responsibilities.
✓
Inspection & Monitoring Results
Inspection results, monitoring records and measurement data may be
reviewed to determine whether required controls are being performed.
✓
Previous Audit Findings
Previous findings may be reviewed to determine whether identified
issues were addressed and followed up appropriately.
✓
Corrective Action Records
Auditors may examine corrective action records and supporting evidence
to verify what actions were taken and whether they were implemented.
✓
Relevant Operational Documents
Operational documents may be checked to confirm that activities are
properly planned, controlled and supported by appropriate information.
✓
System & Electronic Records
Where applicable, auditors may review system entries, electronic
records or other digital evidence related to the audited process.
What Auditors May Ask Employees
During an audit, employees may be asked questions about their roles, responsibilities and how they perform their daily activities.
RESPONSIBILITY
“What is your responsibility in this process?”
Auditors may ask employees to explain their role and the activities they are responsible for.
WORK PROCESS
“How do you normally perform this task?”
This helps auditors understand how work is actually carried out and whether it follows the established process.
PROBLEM HANDLING
“What do you do if something goes wrong?”
Auditors may want to understand how employees respond to problems, errors, nonconformities or unusual situations.
RECORDS
“What records do you complete?”
This helps establish whether employees understand what information needs to be recorded during the process.
VERIFICATION
“How do you know the work has been completed correctly?”
Auditors may look for evidence of inspection, verification, monitoring or other controls used during the process.
What Auditors Are Looking For
Employees do not necessarily need to recite procedures word-for-word. Auditors generally want to see that employees understand their responsibilities and can explain how they perform their work in practice.
Common Gaps Auditors May Identify
During an internal audit, auditors may identify gaps between documented requirements, actual practices and the evidence available to demonstrate that processes are being followed effectively.
RECORDS
Incomplete or Missing Records
Required records may be incomplete, missing information or not maintained as required by the applicable process or procedure.
PROCESS
Procedures Not Being Followed
Actual working practices may differ from documented procedures, instructions or established process requirements.
DOCUMENT CONTROL
Outdated or Uncontrolled Documents
Auditors may identify outdated procedures, obsolete forms or documents that are not properly controlled or available at the point of use.
EVIDENCE
Insufficient Objective Evidence
Employees may perform required activities, but there may be limited evidence available to demonstrate that the activities were completed.
CORRECTIVE ACTION
Corrective Actions Not Fully Addressed
Previous findings may remain open, lack supporting evidence or have actions that do not fully address the identified issue.
RESPONSIBILITY
Unclear Employee Responsibilities
Employees may be unclear about their responsibilities, required controls or the records they are expected to complete.
Internal Audit Checklist: What to Check Before the Auditor Arrives
Before the audit begins, organisations can carry out a final review to confirm that required documents, records, processes and corrective actions are in place and supported by objective evidence.
Review Procedures and Documents
Check that relevant procedures, work instructions and other controlled documents are current, approved and available where required.
Check Required Records
Review required forms, logs, reports and other records to confirm they are complete, accurate and properly maintained.
Verify Previous Corrective Actions
Confirm that previous audit findings and corrective actions have been addressed and that supporting evidence is available.
Confirm Employee Understanding
Make sure employees understand their responsibilities, relevant procedures and the records or controls associated with their work.
Check That Processes Are Being Followed
Compare actual working practices with documented requirements and identify any differences that may need attention.
Review Previous Audit Findings
Review previous findings, observations and follow-up actions to make sure outstanding issues have been properly monitored.
Make Objective Evidence Available
Ensure that relevant records, reports, approvals, inspection results and other supporting evidence can be provided when requested.