A standard internal audit of one process at one location takes six to ten weeks from the kickoff meeting to the final report, consumes 250 to 500 audit hours, and costs the people being audited about 80 to 130 hours of their own time. Those are the medians, and almost nobody experiences the median, because the two things that stretch an audit past ten weeks have little to do with the auditors: how quickly the documents and data arrive, and how many people have to sign the report. The audit that finishes in six weeks is the one where the request list went out before the kickoff, the auditors could pull their own data, findings were agreed as they surfaced, and the draft went through one review rather than four. The audit that takes sixteen is the same audit with three weeks of waiting for a system extract, a process owner on leave, and a report that visited five inboxes.
This guide gives the numbers and what moves them, for both sides of the table. It contains the three clocks every audit runs on and why they are confused, a phase-by-phase timeline with ranges and what extends each phase, durations and hours by audit type from a compliance review to a multi-site operational audit, the ten drivers of duration ranked by effect, what the auditee controls and what each day of delay costs, the nine levers that shorten an audit without cutting assurance and roughly how much each saves, a week-by-week calendar for an eight-week audit, a worked example of MidState Beverage’s route cash audit that was planned at eight weeks and took eleven, and the mistakes that add weeks. It was rewritten in September 2026 to reflect the Global Internal Audit Standards and current practice. The phases themselves are described from the auditee’s side in the site’s auditee’s guide and from the audit function’s in how audit departments prepare for an engagement.
In this guide
- The three clocks: elapsed time, audit hours, and auditee hours
- The timeline by phase, and what extends each
- Duration and hours by audit type
- The ten drivers of duration
- What the auditee controls, and what a day of delay costs
- Nine ways to shorten an audit without cutting assurance
- A week-by-week calendar for an eight-week audit
- Worked example: planned at eight weeks, finished in eleven
- Duration standards a committee can hold the function to
- Common mistakes that add weeks
The three clocks: elapsed time, audit hours, and auditee hours
“How long does an audit take” has three answers, and confusion between them is the source of most disputes about audit duration. Elapsed time is the calendar from notification to final report, which is what the auditee experiences and what the committee sees in the plan status table. Audit hours are the effort the auditors charge to the engagement, which is what the budget measures and what the chief audit executive manages; a 400-hour engagement staffed by two people at 60 percent allocation takes about eight weeks of calendar, and the same engagement staffed by one person at 40 percent takes twenty-five. Auditee hours are the time the business spends supporting the audit, which nobody measures and which is the figure a department head actually wants when they ask the question. The three move independently. An audit can be short in elapsed time and heavy in hours (a team of six on site for two weeks), long and light (one auditor part-time over a quarter), or short for the auditors and long for the auditee (a poorly scoped request list that takes the business three weeks to answer while the auditors wait). A good planning memo states all three, and the site’s cost of an internal audit guide shows how the second and third are priced.
The timeline by phase, and what extends each
Every audit runs the same sequence, and the table gives each phase’s typical duration for a standard single-process engagement, the range seen in practice, and the thing that most often pushes it to the top of the range. The durations overlap in practice (the request list is issued during planning; findings are shared during fieldwork), so the sum of the typical column is longer than the eight weeks a well-run audit takes end to end.
| Phase | Typical duration | Range | What extends it | Who controls the clock |
|---|---|---|---|---|
| Notification to kickoff | 2 to 4 weeks | 1 to 8 weeks | Executive availability; the auditee asking for a delay past a busy period; the audit function’s own scheduling | Both, mostly the function |
| Planning and scoping (interviews, planning memo, request list) | 1 to 2 weeks | 1 to 4 weeks | Interviews hard to schedule; scope disputed; a first-time area with nothing documented | Function, with auditee availability |
| Document and data request turnaround | 1 week to first delivery; additions throughout | 3 days to 6 weeks | System extracts needing IT; documents that do not exist; a coordinator without authority | Auditee |
| Fieldwork (walkthroughs, testing, analytics, interviews) | 2 to 5 weeks | 2 to 10 weeks | Sites; sample size; late data; performers unavailable; findings that expand scope | Function, with auditee availability |
| Preliminary findings and closing meeting | Final week of fieldwork; meeting of 1 to 2 hours | Same week to 3 weeks after fieldwork | Executives unavailable; facts disputed because they were not shared earlier | Both |
| Draft report | 3 to 5 business days after closing | 2 days to 4 weeks | Review layers; rewriting instead of reviewing; findings not agreed at closing | Function |
| Management response | 5 to 10 business days | 3 days to 6 weeks | Owners unassigned; responses negotiated up the chain; disagreement on ratings | Auditee |
| Final report | Within 5 business days of the response | 2 days to 4 weeks | Chief audit executive sign-off queue; last-minute rating debates | Function |
| Follow-up and validation | Action due dates of 1 to 6 months; validation in fixed windows | 1 month to 18 months | Overdue actions; evidence not kept; validation not planned | Auditee for the fix, function for the validation |
Two phases account for most of the variance. The request turnaround is the auditee’s clock, and a request list answered in three days versus three weeks changes the whole engagement by that much, because fieldwork cannot start on data that has not arrived. And the draft-to-final cycle is the function’s clock, and the difference between one review and four is two to three weeks of a report nobody is reading. The Global Internal Audit Standards’ requirement that final communications be timely is aimed at the second; the site’s guide to writing reports people read has the ten-day drafting process that meets it.
Duration and hours by audit type
The type of engagement sets the baseline before any driver applies. The table gives elapsed weeks from kickoff to final report, audit hours, and auditee hours for the common types at a mid-sized organization, assuming a competently run engagement with a responsive auditee; the range columns show what happens when either condition fails.
| Audit type | Elapsed weeks (kickoff to final) | Audit hours | Auditee hours | Notes |
|---|---|---|---|---|
| Compliance review of a policy or regulation in one area | 3 to 5 | 80 to 200 | 20 to 40 | Narrow criteria; often desk-based; the shortest common engagement |
| Single-process operational audit (AP, payroll, procurement at one entity) | 6 to 10 | 250 to 500 | 80 to 130 | The median engagement; the calendar below is built for it |
| Multi-site operational audit (depots, branches, plants) | 10 to 16 | 500 to 900 | 300 to 600 across sites | Travel and site scheduling dominate; analytics across sites shorten it |
| IT general controls or application audit | 6 to 9 | 250 to 450 | 60 to 120, concentrated in IT | Evidence is mostly system-generated; delays come from access provisioning and screenshots |
| Cybersecurity program review | 8 to 12 | 350 to 600 | 80 to 150 | Specialist involvement; technical testing scheduled separately |
| SOX or ICFR testing cycle | Continuous: interim testing Q2 to Q3, roll-forward Q4 | 400 to 2,000 a year depending on scope | 150 to 600 a year | Not an engagement with an end date; a program with quarterly deliverables |
| Advisory or consulting engagement | 4 to 8 | 150 to 350 | 40 to 100 | No assurance conclusion; duration set by the question |
| Investigation | Open-ended: 2 weeks to 6 months | 100 to 2,000 | Variable; often heavy on legal and HR | Driven by what is found; not planned as an audit |
| Follow-up and validation window | 1 to 2 weeks per window | 10 to 15 percent of the original engagement’s hours | 10 to 25 per action | Fixed windows twice a year in a well-run function |
| External quality assessment of the audit function | 6 to 10 | 150 to 400 (the assessor’s) | 100 to 200 (the function’s) | Every five years under the Standards |
The ten drivers of duration
Ranked by how much elapsed time each typically adds to a standard engagement, from experience across functions rather than from a survey; the ranking is stable enough that the top three explain most overruns. Notice that four of the ten sit with the auditee, four with the audit function, and two with both, which is why “the audit is taking forever” is usually a shared achievement.
| Rank | Driver | Typical addition to elapsed time | Whose | Why it happens |
|---|---|---|---|---|
| 1 | Data and document turnaround | 1 to 4 weeks | Auditee (and IT) | Extracts queued behind IT priorities; documents that have to be found or do not exist; a coordinator without authority to chase |
| 2 | Report review layers | 1 to 3 weeks | Function | Every reviewer rewrites; drafts wait in inboxes; facts not settled at closing resurface |
| 3 | Scope expansion during fieldwork | 1 to 3 weeks | Both | Findings open new questions; a request from an executive is absorbed; the auditors follow an interesting thread without re-planning |
| 4 | Number of sites and entities | 1 week per additional site visited | Function (scoping) | Travel, scheduling, and repeating walkthroughs; mitigated by analytics and rotation |
| 5 | Availability of key people | 1 to 2 weeks | Auditee | Process owners on leave, at quarter-end, or in a system go-live; interviews slipping a week each |
| 6 | Management response time | 1 to 3 weeks | Auditee | Responses negotiated up the chain; owners unassigned; disagreement on ratings handled by delay |
| 7 | Undocumented processes | 1 to 2 weeks | Auditee | The auditors have to build the narrative before they can test it; walkthroughs take twice as long |
| 8 | Staffing allocation | Proportional: 40 percent allocation doubles the calendar of 80 percent | Function | Auditors split across engagements; the calendar stretches even though hours do not |
| 9 | Volume of findings | 3 days to 2 weeks | Both | Each finding takes a day to write well and half a day to agree; twelve findings is two weeks of drafting |
| 10 | Specialist scheduling | 1 to 4 weeks, at the start | Function | Co-source specialists booked late; technical testing windows constrained by IT change freezes |
What the auditee controls, and what a day of delay costs
The auditee controls about half the calendar and rarely knows it. Three things are in the auditee’s hands: how fast the request list is answered, how available the performers and the owner are during fieldwork, and how fast the management response comes back. Each has a multiplier, because auditors are scheduled: a day lost waiting for an extract is often not a day added but a week, since the team moves to another engagement and returns when the next block of time is free. A rough rule from functions that track it is that each business day of delay in the first request-list delivery adds one to two calendar days to the final report, and each week the management response runs past its window adds that week plus whatever queue the final report then joins. The table shows the effect on an eight-week baseline.
| Auditee behavior | Effect on an eight-week audit | Why | What to do instead |
|---|---|---|---|
| Request list answered in full within 3 business days | Baseline held; often a week saved | Fieldwork starts on schedule with complete data | Name a coordinator with authority; pre-stage the documents the planning interview made obvious |
| Request list answered piecemeal over 3 weeks | Plus 2 to 4 weeks | Fieldwork starts, stalls, restarts; auditors redeployed between blocks | Answer every item, including “does not exist”; escalate IT extracts on day one |
| Performers available for walkthroughs in week one | Baseline held | Design conclusions reached early; testing scoped correctly | Block the calendar at notification, not at kickoff |
| Owner on leave during fieldwork | Plus 1 to 2 weeks | Facts cannot be confirmed; closing meeting slips | Delegate to a deputy with authority to confirm facts |
| Facts confirmed as findings are shared | Minus 1 week at the report stage | Closing meeting is short; the draft has no factual disputes | Respond to each preliminary finding within two days |
| Management response within 5 business days | Baseline held | Final issued on schedule | Use the response template; assign owners before the draft arrives |
| Response negotiated for 4 weeks | Plus 4 to 6 weeks | The final joins the sign-off queue late; the committee sees “in progress” for another quarter | Disagree in the response in writing rather than by delay |
| Direct read-only data access granted to auditors | Minus 1 to 2 weeks | No extract queue; better evidence | Ask IT for read-only credentials at planning |
The auditee’s own hours follow the same logic: an audit that runs long costs the department more time, not less, because each restart means re-briefing, re-finding, and re-explaining. The auditee’s guide has the full phase table from the auditee’s side and the response template that keeps the last two rows at baseline.
Nine ways to shorten an audit without cutting assurance
There is a wrong way to shorten an audit, which is to test less, and it is covered under the cost guide’s warning about cutting depth. The nine levers below shorten the calendar by removing waiting, rework, and duplicated effort, and none of them reduces the evidence behind the conclusion. The savings are approximate and additive only up to a point; a function that applies all nine consistently runs standard engagements in six weeks rather than ten.
| Lever | What it involves | Typical saving | Who has to act |
|---|---|---|---|
| Request list before kickoff | Issue the numbered request list with the notification, due at the kickoff, so fieldwork starts with data in hand | 1 to 2 weeks | Function |
| Direct data access | Read-only credentials or a standing extract; auditors pull their own populations | 1 to 2 weeks and better evidence | Auditee and IT |
| Fixed scope in the planning memo | Objectives and boundaries written and agreed; additions become a change with hours or a new engagement | 1 to 3 weeks on engagements that would have expanded | Function |
| Daily 15-minute check-in during fieldwork | Open requests, blockers, and emerging findings reviewed with the coordinator every day | 1 week, mostly by preventing stalls | Both |
| Findings shared as they firm up | Each finding confirmed with the process owner within two days of being established | 1 week at the closing and draft stage | Function, with auditee response |
| Facts agreed at closing; one draft | Closing meeting settles condition and actions; the draft is written from the closing notes; one quality review, not four | 1 to 3 weeks | Function |
| Five-day response window with the template | Response format sent with the draft; owners pre-assigned at closing | 1 to 3 weeks | Auditee |
| Concentrated staffing | Two auditors at 80 percent rather than four at 30 percent | Halves the calendar for the same hours | Function |
| Analytics across sites instead of visits | Full-population tests for the conditions that can be coded; site visits for custody and observation only | 1 week per site not visited | Function |
The lever with the best ratio of saving to effort is the first. A request list that arrives with the notification, numbered, with the purpose of each item stated, changes the auditee’s behavior (they start early), the function’s behavior (fieldwork is planned around real data), and the tone of the engagement (it looks organized because it is). The engagement preparation guide has the request list format, and the walkthrough guide the planning checklist that goes with it.
A week-by-week calendar for an eight-week audit
The calendar below is a single-process operational audit of about 350 hours, staffed by an audit lead at 60 percent and a staff auditor at 80 percent, with the notification issued three weeks before week one. It assumes the levers above are applied. The auditee column is what the department should expect to be doing that week, which is the version of this table a department head can put in front of their team.
| Week | Audit team | Auditee | Milestone |
|---|---|---|---|
| Before week 1 (3 weeks prior) | Notification memo; planning interviews; planning memo; request list issued with the notification | Coordinator named; calendars blocked; request list started | Planning memo approved; request list due at kickoff |
| 1 | Kickoff meeting; request list reconciled; population tie-outs; walkthroughs begin with performers | Request list delivered; performers available for walkthroughs; daily check-in starts | Design conclusions drafted by Friday |
| 2 | Walkthroughs complete; design conclusions and test plan finalized; samples drawn and frozen; analytics built and run | Retrieval of sampled items begins; explanations for analytics exceptions requested | Work program finalized; first preliminary finding shared if design gaps found |
| 3 | Testing of samples; analytics exceptions reviewed; interviews on emerging issues | Item retrieval; explanations within two days; facts confirmed on preliminary findings | Half of testing complete |
| 4 | Testing complete; findings drafted as headlines with counts; cause discussions with owners | Facts confirmed; cause discussed; owners for likely actions identified | All preliminary findings shared by Friday |
| 5 | Closing meeting (facts, cause, rating preview, actions); draft written from closing notes within two days; readability pass; quality review | Closing meeting attendance; agreement on actions, owners, and dates | Draft issued to management by Friday with the response template |
| 6 | Available for questions; validation planning; workpaper completion and review | Management response drafted and returned within five business days | Response received |
| 7 | Responses incorporated verbatim; final review by the chief audit executive; issue log updated | Team briefed by the department head before circulation | Final report issued |
| 8 | Post-engagement survey to the executive; file closed; lessons noted | Actions begin; evidence kept from day one | Engagement closed; follow-up scheduled |
The calendar has one deliberate feature: the draft is issued at the end of week five, not week eight, because everything after the closing meeting is administration and response time, and a function that treats the closing meeting as the point at which the substance is done has the report out in a fortnight. Functions that run ten to twelve weeks on the same engagement are almost always spending the extra weeks between the closing meeting and the final report.
Worked example: planned at eight weeks, finished in eleven
MidState Beverage’s FY27 route cash audit covered twelve depots, 300 routes, and 37,400 settlements, was planned at 520 hours over eight weeks with two seniors, a staff auditor, and an IT auditor for analytics, and issued its final report (FY27-01, Unsatisfactory, five findings) in week eleven at 548 hours. The overrun in hours was 5 percent; the overrun in calendar was 38 percent, and the table shows where the three weeks went. The lesson the function took from it is in the last row.
| Week | Planned | What happened | Calendar effect | Driver |
|---|---|---|---|---|
| 1 | Kickoff; settlement and deposit extracts received; walkthroughs at two depots | Kickoff held; extracts delayed because the route module’s report writer could only be run by one IT analyst who was on leave; walkthroughs proceeded | Analytics start slipped 8 business days | Data turnaround (rank 1) |
| 2 to 3 | Analytics across all twelve depots; site visits to two more depots; sample of 60 reconciliations drawn | Site visits done; sample drawn from a listing tied to the ledger; analytics ran in week 3 once the extract arrived and immediately flagged override clustering at four depots | On plan for site work; analytics a week late | — |
| 4 | Testing complete; preliminary findings shared | The override clustering required an additional depot visit and 30 explanations from settlement clerks; the operations VP asked for the two acquired distributors to be added to the scope | Plus 1 week; the scope request was declined and logged for the acquisition integration engagement | Scope expansion (rank 3), managed |
| 5 | Closing meeting; draft | Closing meeting held on schedule for the Central Region; the operations VP disputed the override finding’s rating and requested a second meeting with the CFO present, held six days later | Plus 1 week | Availability and rating dispute (ranks 5 and 6) |
| 6 to 7 | Response; final | Draft issued day 2 of week 6; management responses for three of five findings returned in five days; the override and reconciliation responses took twelve days because the owner for the module role change (IT) had not been at the closing meeting | Plus 1 week | Response time (rank 6); owner not present at closing |
| 8 to 11 | — | Final report issued in week 11 after the chief audit executive’s review and one further factual correction on customer statement counts (94 corrected to 88) | Final three weeks late in total | — |
| Lesson | — | The function now requests extracts at notification, three weeks before kickoff, and requires every action owner to attend the closing meeting; the FY28 depot rotational reviews ran to calendar | — | — |
The example is typical in one respect that reassures auditees: the overrun did not come from the audit finding more than expected, which it did, but from waiting and from people not being in the room. The extra findings cost hours; the extra weeks cost nothing but calendar. The issue validation guide covers the phase that followed, in which the three Fort Wayne actions were validated in the first window because the depot had kept its evidence as it went.
Duration standards: what a committee can hold the function to
“How long should an audit take” is a fair question for an audit committee to ask its function, and the useful answer is a set of standards the function commits to and reports against, not a single number. The standards below are the ones mature functions publish in their methodology and measure quarterly; each is a promise about a part of the calendar the function controls, with the auditee’s part stated as an expectation so that the committee can see where an overrun came from. A function that meets these standards runs the median engagement in six to eight weeks and can show the committee, engagement by engagement, why any one ran longer.
| Standard | Commitment | Measured as | Reported to the committee |
|---|---|---|---|
| Notification lead time | Written notification at least 15 business days before kickoff, with the request list attached | Business days between notification and kickoff; request list issued with notification (yes or no) | Share of engagements meeting the standard |
| Request list expectation (auditee) | Complete response, including “does not exist” answers, within 5 business days of kickoff | Business days to complete first response | Median days by engagement; overruns attributed |
| Preliminary findings | Every finding shared in writing within 2 business days of being established; no finding first raised at the closing meeting | Days from establishment to sharing; count of findings first raised at closing (target zero) | Exceptions listed |
| Closing meeting | Held within 5 business days of fieldwork completion with every likely action owner present | Days from fieldwork end to closing; owner attendance | Share meeting the standard |
| Draft report | Issued within 5 business days of the closing meeting | Days from closing to draft | Median and distribution |
| Management response expectation (auditee) | Returned within 5 business days of the draft using the template; disagreement recorded in the response, not by delay | Days from draft to response | Median; late responses by owner |
| Final report | Issued within 5 business days of the response; where the response is late, the report issues with the response marked outstanding after 15 business days | Days from response to final; reports issued with responses outstanding | Median; count issued with outstanding responses |
| End-to-end cycle | Kickoff to final report within 8 weeks for a standard engagement, 12 for multi-site | Calendar weeks | Every engagement against its standard, with the driver named for any overrun |
| Validation | Closed actions validated within 60 days of management’s closure claim, in fixed windows | Days from claim to validation | Share validated within 60 days; overdue validations listed |
The seventh row contains the rule that ends most response-time disputes: after fifteen business days the report issues with management’s response marked as outstanding, which converts a delay into a visible fact in the committee pack and, in practice, produces the response within a day. The Global Internal Audit Standards’ requirement that final communications be timely gives the chief audit executive the authority to set that rule; the GIAS Domain V guide covers Standard 15.1, and the site’s guide to setting up a small-company function shows the same standards in a one-person function’s charter.
Common mistakes that add weeks
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Request list at kickoff | The list is handed over at the meeting and fieldwork waits for it | Two to three weeks of the calendar spent waiting | Issue it with the notification; due at kickoff |
| Extracts requested late | IT asked for data in week one | IT queues run in weeks | Request at notification; ask for direct read access |
| Open-ended scope | “We’ll see where it leads” | Every interesting thread adds a week | Scope fixed in the memo; changes are decisions with hours |
| Findings saved for the end | No surprises rule ignored; everything lands at closing | Facts disputed after the fieldwork team has moved on | Share and confirm findings within two days of establishing them |
| Owners absent from closing | The IT owner of a fix is not in the room | The response waits for someone who was never asked | Every likely action owner attends |
| Serial review | Draft to the manager, then the director, then the CAE, each rewriting | Three weeks of edits that change nothing the reader needs | One quality review against facts and rating definitions |
| Negotiating by delay | Management holds the response to soften the rating | The final slips a quarter; the committee sees “in progress” | Fixed response window; disagreement in writing; the CAE issues after the window |
| Thin staffing | Four auditors at 25 percent each | Calendar quadruples for the same hours; continuity lost | Two people concentrated |
| Visiting every site | Twelve depots, twelve trips | Twelve weeks of travel for what analytics could see in one | Analytics for the population; visits for custody and observation |
| No follow-up plan | Validation done “when there’s time” | The engagement never actually ends; the committee cannot see closure | Fixed validation windows in the plan |
Six to ten weeks is the honest answer, and which end of the range an audit lands on is decided in the three weeks before it starts and the two weeks after the closing meeting, by the request list and the report cycle, more than by anything that happens during fieldwork. Auditees who want a short audit answer the list fast and confirm facts as they come; functions that want one issue the list early and write one draft. The site’s guide to when an internal audit is most likely covers the selection question that precedes this one, and ten tips for navigating an audit the auditee’s short list.
Related guides
- What to expect during an internal audit — the phases from the auditee’s side
- How audit departments prepare for an engagement — the request list and planning memo
- How much does an internal audit cost? — the hours behind the calendar
- How to write an audit report people read — the ten-day drafting process
- Audit walkthroughs — the first week of fieldwork
- Issue validation — the phase after the report
- How to build an internal audit plan — staffing allocation and sequencing
- Audit sample sizes — why testing takes the time it takes
- When is an internal audit most likely? — the selection question
- Ten tips for navigating an internal audit — the auditee’s short list
- All Guides — the full index
Leave a Reply