The internal audit function: operations, planning, quality and follow-up
The internal audit function needs a mandate, appropriate independence, capable resources, a risk-based audit plan, quality assessment and a way to communicate and monitor results. The chief audit executive manages this system while the board provides oversight and management owns corrective action.
- 1
Prioritize
Connect the audit plan to organizational risk.
Output: A justified engagement portfolio
- 2
Resource
Match skills, capacity and methods to the plan.
Output: Deliverable work
- 3
Evaluate
Assess quality and communicate results.
Output: Evidence about conformance and effectiveness
- 4
Improve
Monitor actions and update plans and methods.
Output: A function that responds to change
Keep portfolio and engagement decisions separate
The function decides which risks merit audit attention and whether it has the capacity to address them. An engagement team then designs detailed objectives and tests. A well-executed low-priority engagement does not prove that the portfolio covers the organization’s most important risks.
| Level | Example decision | Evidence |
|---|---|---|
| Function | Reprioritize after a major acquisition | Updated risk assessment and audit plan |
| Engagement | Test access controls at the acquired company | Objectives, criteria and work program |
Function
- Example decision
- Reprioritize after a major acquisition
- Evidence
- Updated risk assessment and audit plan
Engagement
- Example decision
- Test access controls at the acquired company
- Evidence
- Objectives, criteria and work program
Build the operating model around the mandate
Consider an audit function supporting a retailer that has acquired an online marketplace. The mandate defines the function’s authority and responsibilities; the strategy and plan translate them into a practical direction. The new business introduces different systems, data and third-party dependencies, so last year’s coverage cannot simply be copied.
The CAE needs a view of the relevant risks, existing assurance and available capability. That view supports a decision about which engagements matter most. An individual engagement then needs its own objective, scope and work program. The function-level decision explains why the work is in the portfolio; the engagement plan explains how it will be done.
Make capacity constraints explicit
Suppose the team has enough hours to complete two reviews, but neither assigned auditor has the required systems expertise for the acquisition work. Reallocating hours from a routine review may help capacity but not competence. Consider training, qualified support or a different scope and explain the consequences of the choice.
Keep oversight parties informed about what can be delivered and what exposure remains unaddressed. A fully populated calendar is not the same as a feasible plan. The operational model should connect commitments to the skills, methods and tools needed to carry them out.
Quality is broader than the number of reports issued
Use a quality assurance and improvement program to evaluate the function. Internal assessments and external assessments serve distinct purposes. An output measure such as reports completed is informative, but it does not establish that conclusions were supported or important risks covered.
| View | What it helps assess | Limitation |
|---|---|---|
| Engagement supervision | Support and consistency in a particular engagement | Does not replace function-wide assessment |
| Internal assessment | Ongoing monitoring and periodic self-assessment | Needs appropriate method and follow-through |
| External assessment | Independent evaluation of the function | Does not replace continuing internal improvement |
Engagement supervision
- What it helps assess
- Support and consistency in a particular engagement
- Limitation
- Does not replace function-wide assessment
Internal assessment
- What it helps assess
- Ongoing monitoring and periodic self-assessment
- Limitation
- Needs appropriate method and follow-through
External assessment
- What it helps assess
- Independent evaluation of the function
- Limitation
- Does not replace continuing internal improvement
Evaluate a recurring quality failure at the right level
Imagine several reports require factual corrections after issue. Fixing each report is necessary, but the repeated pattern suggests a problem in the method, review or evidence process. Examine how facts are validated, what supervisors review and whether staff understand the required support for conclusions.
Assign an improvement action and define how you will assess whether it worked. A reduction in corrections may be useful, but also inspect whether the reports still address material matters and whether issues are being hidden rather than prevented. A single measure can create an incomplete picture.
Separate delivery measures from quality evidence
Reports issued and planned hours used describe output and efficiency. They do not directly establish whether the function covered important risks or supported its conclusions. Use complementary information about relevant coverage, evidence quality, stakeholder communication and improvement actions.
An external assessment and internal monitoring have different roles in a quality program. A favorable assessment does not eliminate the need to improve current work. Likewise, an engagement supervisor’s review is valuable but does not by itself evaluate the whole function’s governance, methods and performance.
Track the evidence behind each action status
Assign an action owner and target date, then document the evidence used to verify implementation. An overdue action and an implemented-but-ineffective action need different responses. Escalate unresolved risk through the appropriate governance process rather than quietly changing the status.
| Status | Evidence | Next step |
|---|---|---|
| Planned | Management has agreed an action | Track the owner and due date |
| Implemented | The control or process has changed | Verify operation as appropriate |
| Effective | Testing supports the intended result | Document the basis for closure |
| Unresolved | The risk remains or action is overdue | Communicate and escalate appropriately |
Planned
- Evidence
- Management has agreed an action
- Next step
- Track the owner and due date
Implemented
- Evidence
- The control or process has changed
- Next step
- Verify operation as appropriate
Effective
- Evidence
- Testing supports the intended result
- Next step
- Document the basis for closure
Unresolved
- Evidence
- The risk remains or action is overdue
- Next step
- Communicate and escalate appropriately
Follow one action from agreement to verified status
The acquisition audit identifies that former employees retain access. Management agrees to revise the termination workflow and assigns an owner and date. At that point, the action is planned. A new procedure and system configuration can demonstrate implementation, but evidence from subsequent terminations is needed to evaluate operation.
Choose verification proportionate to the issue and the available evidence. Record what was examined and what conclusion it supports. If a part of the response remains incomplete, preserve that limitation instead of moving the whole action to “closed” because the due date has passed.
Different unresolved states need different responses
An overdue action may need an explanation, revised commitment and communication about continuing exposure. An implemented action that fails testing needs reassessment of the response. A deliberate decision to accept risk requires appropriate governance attention. These are different situations, even if all appear as red rows on a dashboard.
Internal audit communicates and escalates through the appropriate process while management retains operational responsibility. Taking over the fix can create a future self-review concern. The function’s value lies in clear evidence, relevant conclusions and persistent monitoring, not in making every status indicator green.
Connect the function’s records
A useful operating model lets a reviewer follow a risk from the portfolio decision through delivery, findings and improvement. The example below connects records rather than prescribing one software system.
| Record | Decision supported | Link to the next stage |
|---|---|---|
| Risk and assurance map | Prioritize the new marketplace | Explain the engagement’s place in the plan |
| Resource assessment | Obtain appropriate systems expertise | Set a feasible delivery scope |
| Engagement file | Support conclusions about access controls | Create clear findings and agreed actions |
| Action register | Track and verify the response | Identify residual exposure and recurring themes |
| Quality review | Improve methods that produced weak evidence | Revise training, supervision or planning |
Risk and assurance map
- Decision supported
- Prioritize the new marketplace
- Link to the next stage
- Explain the engagement’s place in the plan
Resource assessment
- Decision supported
- Obtain appropriate systems expertise
- Link to the next stage
- Set a feasible delivery scope
Engagement file
- Decision supported
- Support conclusions about access controls
- Link to the next stage
- Create clear findings and agreed actions
Action register
- Decision supported
- Track and verify the response
- Link to the next stage
- Identify residual exposure and recurring themes
Quality review
- Decision supported
- Improve methods that produced weak evidence
- Link to the next stage
- Revise training, supervision or planning
Original worked case
A productive team with a coverage gap
The function completes every engagement in its annual calendar, but a new acquisition creates a material risk that was absent when the calendar was approved.
Reveal the decision and reasoning
Reassess the risk-based plan, discuss priorities and resource implications, and update coverage as appropriate.
Completing the original calendar is an output. The function must also remain responsive to the organization’s changing risks.
An editorial teaching example, not an official IIA question or a prediction of exam content.
Common questions
- Who owns the corrective actions after an audit?
- Management owns the operational action. Internal audit monitors and evaluates implementation and communicates unresolved matters through the appropriate process.
- Is the function’s quality measured only by speed?
- No. Timeliness matters alongside supported conclusions, relevant coverage, conformance and useful communication.
Sources and editorial notes
Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.
- The IIA: Part 3 expanded syllabus
- Operations, plan, quality, results and monitoring domains.
- Engagement Results and Monitoring.
- The IIA: quality assurance and improvement
- QAIP components and assessment responsibilities.
MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.