The month before an internal audit is the only part of it you fully control. Once fieldwork starts, the auditors set the pace, choose the samples and decide what to test. Before it starts, you decide how well you understand your own process, how quickly you can produce evidence, what you tell the auditors about problems you already know of, and whether your team walks into the first interview informed or anxious. Managers who use that month well tend to have shorter audits, fewer surprises and findings that are accurate, even when the findings are not good news.
There is a second kind of preparation, and it does more damage than no preparation at all: rewriting procedures the week before, backfilling approvals, tidying data extracts, running a control for the first time in months so that it looks routine. An audit tests a period that has already happened, and experienced auditors notice when the evidence was assembled for them. This guide sets out a four-week plan in ten steps for managers and process owners, the tidying up to avoid, what changes if it is your first audit or your site is one of many, and a worked example of one manager’s month before a site review. It was rewritten in September 2026 and is part of the site’s guide for people being audited.
In this guide
- What preparation is for, and what it cannot do
- The month at a glance
- The ten steps
- Preparing for the walkthrough
- The tidying up that does damage
- The checklist for the day before fieldwork
- If you have two weeks, or less
- If this is your first audit
- If your site is one of many
- Worked example: a depot manager’s month before a site review
- Questions managers ask about preparing
- Related guides
What preparation is for, and what it cannot do
Most audits test a period that ended before the notification arrived: the last six or twelve months of transactions, reconciliations, approvals and access changes. Nothing you do in the month before fieldwork changes what happened in that period, and preparation that tries to is the kind that turns an ordinary finding into a question about integrity. What preparation can do is make sure the audit sees the period accurately, runs efficiently and gives you credit for what you already know and are already fixing. That is worth a great deal, because inaccurate findings, slow evidence and surprises at the closing meeting are the three things that make audits go badly for the people being audited.
| Preparation that helps | Tidying up that does damage |
|---|---|
| Understanding your process as it actually runs, including when it changed | Rewriting the procedure so that it matches what the auditors will expect |
| Knowing where the evidence for each control is, and how to produce it quickly | Creating evidence that should have existed but does not |
| Checking your own evidence and finding the gaps first | Filling the gaps with documents dated to the past |
| Telling the auditors about problems you know of, and what you are doing about them | Hoping they will not look there |
| Fixing problems going forward, with the date the fix started | Presenting the fix as if it had always been in place |
| Briefing your team on what an audit is and what to expect | Coaching your team on what to say |
| Producing complete data extracts with control totals | Filtering the data before it goes to the auditors |
The left column is also where the real savings are. Audit teams budget time for chasing evidence and clarifying how processes work. When an area produces complete evidence quickly and explains its process accurately, the auditors spend their hours testing rather than waiting, and the audit finishes sooner. The site’s guide to how long an internal audit takes shows how much of an audit’s duration the auditee controls.
The month at a glance
Most functions give two to four weeks’ notice before fieldwork. The plan below assumes four; with two, compress the first two weeks into one and keep the order. Timing is counted back from the first day of fieldwork.
| When | Steps | Output | Your time |
|---|---|---|---|
| Four weeks before | 1. Understand why and what. 2. Name a coordinator and block calendars. 3. Reread the last report and check open actions. | Scope, objectives and period understood; coordinator named; action status confirmed | Two to three hours |
| Three weeks before | 4. Map the process as it runs, with the dates it changed. 5. Check your own evidence for the period. | A one-page process summary; a list of evidence gaps you found | Four to six hours, plus the coordinator’s time |
| Two weeks before | 6. List what you know is wrong and decide what to disclose. 7. Prepare standard documents and data sources. | A disclosure note; a document pack and tested extracts | Three to four hours |
| One week before | 8. Check access and permissions. 9. Brief your team. 10. Plan the kickoff. | Access issues known; team briefed; your kickoff points and questions | Two to three hours |
| Fieldwork | Answer requests daily; keep a log of what was provided | No request older than its due date | Depends on the audit |
The ten steps
1. Understand why the audit is happening and what it will cover
Read the notification carefully and then ask the audit lead the four questions it may not answer: what drove the selection of your area, what the objectives are, which period will be tested, and what criteria your process will be measured against, whether a policy, a regulation or a procedure. Standard 13.1 of the Global Internal Audit Standards requires auditors to communicate an engagement’s objectives, scope and timing to management, so these are ordinary questions and most audit teams answer them in a short call. The answers tell you where the auditors will spend their time. The site’s guide to how audit plans choose what gets audited explains the likely reasons behind the selection.
2. Name one coordinator and block the calendars
One person should receive every request, track it and send every response. Without a coordinator, requests go to whoever the auditors happen to email, answers arrive from three people in three formats, and nobody knows what is outstanding. The coordinator does not need to be senior; they need to know who holds what and to be available during fieldwork. Then block time: yours for the kickoff, the preliminary findings discussion and the closing meeting; the coordinator’s for the fieldwork weeks; and your subject experts’ for walkthroughs. Check leave. An audit that meets your team’s only expert on the day she starts a fortnight’s holiday will either wait or guess.
3. Reread the last report and check every open action
If your area has been audited before, the previous report is the best guide to what the auditors will look at first, and any open actions from it are likely to be tested. For each action, confirm its status honestly: implemented and evidenced, implemented but not yet evidenced, in progress, or not started. An action reported as complete that turns out not to be is one of the fastest ways to a repeat finding with a higher rating, so if a completed action has drifted, say so. The site’s guide to issue validation explains how auditors test that actions are closed.
4. Map the process as it runs today, and note when it changed
Write a one-page summary of your process: the main steps, the key controls, who performs each, what system is used, and what evidence each control leaves. Write it as the process actually runs, not as the procedure says it should. If the two differ, note where and why; that is exactly what the walkthrough will uncover, and it is far better coming from you. Above all, list the changes during the audit period with their dates: a new system, a new reviewer, a changed threshold, a reorganization. Auditors test a control from the date it started, and without dates they will test the new control against the whole period and find it missing for the months before it existed.
5. Check your own evidence for the period
For each key control, pick a handful of instances from the audit period, five or ten, spread across the months, and check that the evidence exists and shows what it should: the reviewer’s approval with a date, the reconciliation with its sign-off, the exception report with notes of follow-up. This is a self-test, not a repair. Where you find gaps, record them and move on to step six. Do not create the missing evidence. The purpose is to know before the auditors do, so that you can tell them, explain the cause and show what you are doing about it.
6. List what you know is wrong, and disclose it
Every area has problems its manager already knows about: a control that lapsed during a busy quarter, a backlog of reconciling items, a system report nobody trusts, a vacancy that left a review unperformed. Write them down with what caused them and what you have done or are doing. Then tell the auditors at the kickoff. Disclosure changes how a problem is reported: the final report must acknowledge actions management has already started or completed, under Standard 15.1, and many functions distinguish issues management identified from ones the auditors found. It also changes the audit’s tone. Auditors who are told about problems spend less time looking for others, and managers who disclose are believed when they say something is working.
7. Prepare standard documents and test your data extracts
Some requests appear in almost every audit, and they can be ready before the list arrives: the organization chart, current procedures with their version history, the delegation of authority, key system reports, the list of users with access to the main systems, and the population of transactions for the period. For data, the important thing is completeness. Run the extract, record the parameters, reconcile its totals to the ledger or a system report, and keep the query so it can be rerun. An extract that the auditors cannot prove is complete will be re-requested or re-performed, which costs more time than preparing it properly. The site’s PBC survival guide covers the request list itself.
8. Check access and permissions
Access findings are among the most common in any audit that touches a system: leavers who still have accounts, movers who kept their old permissions, users who can both create and approve transactions. Pull the list of users of your main systems and check it against your team. Where you find a problem, request the change now and keep the request, with its date. The auditors will still see that the access existed during the period, but a removal already requested, and a check you performed yourself, show a control environment that works. The site’s guide to segregation of duties explains the conflicts auditors look for.
9. Brief your team
Tell your team that an audit is coming, what it covers, roughly when, and who may be asked to talk to the auditors. Explain that the audit is about the process, not about them. Then give three pieces of guidance and no more: answer the question asked, accurately; say “I don’t know, but I will find out” rather than guess; and show the auditors how the work is really done, not how the procedure says it should be. Do not rehearse answers, suggest what to leave out, or ask people to report back on what they were asked. Coached answers are easy to spot, contradict each other under follow-up, and can turn a process finding into a finding about the control environment. The site’s guide to when internal audit interviews you is a useful thing to send your team.
10. Plan the kickoff meeting
The kickoff is your best opportunity to shape the audit, and most managers waste it by listening politely. Prepare three things. A short overview of your area: what it does, its volumes, its systems and what changed during the period. Your disclosures from step six. And your questions: how findings will be rated, and whether you can have the rating definitions; how and when potential findings will be discussed with you; who receives the report; and what the audit team needs from you logistically. Ask for the rating definitions in particular. Reading them before any finding exists is the difference between arguing a rating from the rules and arguing it from your feelings, which the site’s guide to disagreeing with a finding explains.
Preparing for the walkthrough
Early in fieldwork, the auditors will ask someone to walk them through the process: how a transaction starts, what happens to it, which system records it, who checks what, and what evidence each check leaves. The walkthrough is where the auditors form their view of how the process is designed, and it decides what they go on to test. It is worth preparing for, in a particular way. Choose the person who actually does the work, not the person who can best describe the procedure. Use the live system, with a real recent transaction, rather than slides or a flowchart. Follow one transaction from start to finish, including the awkward parts: the manual workaround, the exception queue, the report someone exports to a spreadsheet every Friday.
The most common walkthrough problem is a difference between the process as documented and the process as performed, explained away in the room. If your team does something differently from the procedure, the walkthrough is the moment to say so plainly, with the reason. Auditors then test the control you actually rely on, which is what you want. If the difference emerges later from testing, the finding will be about both the control and the documentation. The site’s guide to process walkthroughs shows what auditors are trying to establish, and the guide to walkthroughs versus tests of controls explains what happens next.
The tidying up that does damage
Almost nobody who damages an audit sets out to deceive. The damage comes from an instinct to present the area at its best, applied to a period that has already happened. Auditors see the results often enough to recognize them, usually from dates: a procedure last modified the week before fieldwork, approvals all signed in the same ink on the same day, a log whose entries are too regular. Once they have seen one, they widen their testing, and a finding that would have been about a control becomes a question about whether the area’s evidence can be trusted.
| What managers do | Why it backfires | What to do instead |
|---|---|---|
| Rewrite the procedure the week before fieldwork | The file date shows it; the auditors test the period against the new version and ask why it changed | Update it if it needs updating, date it, and tell the auditors what changed and when |
| Obtain sign-offs now for reviews that happened months ago | Backdated evidence is an integrity issue, not a control issue | Say the review happened but was not evidenced, if that is true |
| Fill gaps in a log from memory | Entries look uniform; details fail under follow-up | Leave the gap and explain it |
| Run a lapsed control for the first time in months, just before fieldwork | The auditors test the period and find it missing before that date | Restart it, record the restart date and disclose the lapse |
| Filter or clean a data extract before sending it | Totals will not reconcile; the auditors re-perform it | Send the complete extract with its parameters and totals |
| Delete old emails or files | Can breach retention rules; looks like concealment | Leave records as they are |
| Close open issues in bulk before the audit | Closures without evidence are reopened, and noticed | Update status honestly |
| Rehearse your team’s answers | Answers contradict each other under follow-up | Brief them on the process, not on what to say |
| Move a struggling employee out of the way for the audit | The auditors find the gap anyway, and ask why | Deal with performance on its own terms |
The common thread is simple. Change anything you like going forward, with its date. Change nothing about the past. If you are unsure whether something crosses the line, the test is whether you would be comfortable telling the auditors exactly what you did and when. If you would, it is preparation. If you would rather they did not ask, it is not.
The checklist for the day before fieldwork
On the day before fieldwork starts, run through the list below. Every item should either be done or have a known reason why not. None of it involves changing anything about the period being audited.
| Item | Ready when |
|---|---|
| Scope, objectives, period and criteria | You can state them in two sentences |
| Coordinator | Named to the audit team, with a backup for leave |
| Calendars | Kickoff, walkthroughs and the closing meeting window are blocked |
| Previous findings | Every open action has an honest status and its evidence located |
| Process summary | One page, as the process runs, with the dates of changes |
| Self-test | Each key control sampled; gaps recorded, not repaired |
| Disclosure note | Known problems, causes and actions, ready for the kickoff |
| Standard documents | Organization chart, procedures with version history, delegation of authority |
| Data | Population extracts run, parameters recorded, totals reconciled |
| Access | User lists checked; changes requested and dated |
| Team | Briefed on the audit, the people likely to be interviewed and the three rules for answering |
| Kickoff | Overview, disclosures and questions prepared, including a request for the rating definitions |
| Request log | A simple tracker ready for the coordinator: item, owner, due, sent |
If you have two weeks, or less
Short notice is common, particularly for audits added to the plan after an incident or moved forward to fill a gap in the schedule. With two weeks, do steps one, two and six in the first two days: understand the scope, name the coordinator and write down what you already know is wrong. Spend the rest of the first week on steps four and seven, the process summary and the data, because those save the most fieldwork time. Use the second week for the team briefing and the kickoff. The self-test in step five can shrink to three or four instances per key control. With less than a week, concentrate on the disclosure note and the coordinator, and tell the audit lead honestly which documents will take longer to produce. A short list of what will arrive when is worth more to the auditors than a promise to send everything at once.
If this is your first audit
A first audit is harder to prepare for because you do not know what normal looks like. Three things help. Read the site’s guide to what to expect during an internal audit, which walks through the phases, a typical request list and what each rating means. Ask the audit lead for a short call before the kickoff to explain how the audit will run; most are glad to, because a well-informed auditee is easier to audit. And do not over-prepare. First-time auditees tend to produce binders of documents nobody asked for, or to spend weeks perfecting a process they will be audited on as it was, not as it is. The ten steps above are enough. For the personal side of a first audit, which is often the hardest part, the site has a guide to audit anxiety.
If your site is one of many
Many audits cover a network of similar locations: branches, depots, stores, plants. If your site is one of them, two things change. First, the design of most controls is set centrally, so your preparation should focus on operation: whether the controls the head office designed are performed at your site as designed, and whether the evidence is there. Second, your results will be compared with other sites’. Auditors look for sites that differ from the rest, because a local variation is either a weakness or a better practice worth spreading. If your site does something differently, for a good reason, say so at the kickoff and explain why. A variation the auditors discover is a finding; one you explain is often a footnote, and sometimes a recommendation for the other sites.
Worked example: a depot manager’s month before a site review
MidState Beverage, the three-state drinks distributor used across this site, audited route cash handling at all twelve of its depots in the first quarter of its FY27 plan, and the report was rated Unsatisfactory. The plan also scheduled limited reviews, later in the year, at five of the depots the main audit had not visited in person, to test the redesigned controls once they were in place. Marcus Hale manages the Lima depot, one of the five. He received four weeks’ notice of a two-day visit covering February to April 2027, the first three months after the new reconciliation workflow went live.
| Week | What Hale did | What he found |
|---|---|---|
| Four weeks before | Asked the audit lead for the scope: the route cash controls as redesigned after report FY27-01, tested for February to April. Named his senior settlement clerk as coordinator. Read the FY27-01 report and the actions that applied to every depot. | Three company-wide actions touched Lima: regional review of settlement reconciliations, removal of clerks’ approval rights over their own overrides, and retirement of the deposit spreadsheet. |
| Three weeks before | Wrote a one-page summary of the depot’s settlement process with the dates of each change. Sampled ten reconciliations a month for the period and checked each for regional finance’s approval in the workflow. | Four March reconciliations had been approved three to five days late, during the regional reviewer’s leave; no backup reviewer had been set up in the workflow. |
| Two weeks before | Told regional finance, which set up a backup reviewer that week. Wrote a two-line disclosure for the kickoff. Pulled the override exception reports and the settlement extract for the period, with totals reconciled to the ledger. | The override reports showed no self-approved overrides after the role change. |
| One week before | Checked the users of the route accounting module against his staff list. Briefed the team at the morning meeting. Prepared the kickoff. | A clerk who had transferred to the Toledo depot in March still held Lima settlement rights; Hale requested removal the same day and kept the request. |
One moment in the month mattered more than the rest. When Hale found the late March approvals, his office administrator suggested asking the regional reviewer to “re-approve” them with the correct dates. Hale said no, for the reason this guide gives: the approvals happened when they happened, and the fix belonged in the future, not in March. At the kickoff he disclosed both problems, the late approvals and the transferred clerk’s access, with what had been done about each.
The review found exactly those two issues and nothing else. Both were reported as Low, both were noted as identified and addressed by management before fieldwork, and the depot’s review concluded that the redesigned controls were operating. The audit took a day and a half instead of two, because every request was answered from the pack Hale’s coordinator had prepared. Compare the Fort Wayne depot manager in the main audit, described in the site’s guide to what to expect during an internal audit, who rewrote her depot’s procedure the week before fieldwork and spent part of the audit explaining why.
Questions managers ask about preparing
Should I fix problems I find before the audit starts?
Yes, going forward, and tell the auditors what you fixed and when. The audit will still report what happened during the period, but the report must acknowledge the action you took, and a fix already under way usually makes the resulting finding easier to close.
There is no written procedure for our process. Should I write one?
If it would help your team, write it, date it today and tell the auditors it is new. Do not present it as the procedure that governed the period. A missing procedure may be a finding in itself; a new one written in response is evidence that you have started to fix it.
How much time should preparation take?
For a manager, roughly ten to fifteen hours spread across the month, as in the calendar above. For the coordinator, more, mostly on documents and data. If preparation is taking weeks of your time, you are probably trying to perfect a process rather than to describe it.
Can I ask the auditors exactly what they will test?
You can ask for the objectives, the scope, the period and the criteria, and you should. The detailed test steps and samples are often not shared in advance, particularly where surprise matters, and asking for them tends to suggest you want to prepare the samples rather than the process.
What if a key person will be on leave during fieldwork?
Tell the audit lead as soon as you know. The auditors may schedule that person’s walkthrough before the leave, or the team may move fieldwork by a week. Leaving it until the auditors ask for someone who is away turns a scheduling problem into a delay.
Should I mention problems that sit in another department?
If they affect your process, yes, factually and without blame: “our reconciliation depends on a file from treasury that often arrives late.” The auditors will find the dependency anyway, and hearing it from you helps them locate the cause correctly, which matters later when actions are assigned to whoever controls the fix.
Related guides
- Being audited? — every guide for auditees and management, by stage of the audit.
- What to expect during an internal audit — the phases, the requests and what each rating means.
- The PBC survival guide — triaging and answering the request list.
- When internal audit interviews you — walkthroughs, interviews and how to answer.
- What not to say to your internal auditor — phrasing for every stage.
- When will internal audit come? — why your area was chosen.
- How long an internal audit takes — what the auditee controls.
- The notification letter and kickoff deck — what the auditors send and present.
- Living with internal audit year-round — so the next audit needs less preparation.
- Audit evidence — what auditors accept and why.
Leave a Reply