Internal audit has a vocabulary that new auditors, the people being audited and audit committee members all have to learn, and most of it is never taught; it is absorbed from senior colleagues, guessed from context or looked up quietly after a meeting. Some of it is precise (a deviation is not an error; a finding is not an observation in every function), some of it is borrowed from external audit with a changed meaning, and some of it is acronyms that stand for documents no one has read in years. This glossary defines 120 terms in plain English, each with a one-line example of the term in use, grouped the way the work is organized rather than alphabetically, so that the terms you meet in planning sit together and the terms you meet in the report sit together.
The groups: the function and its governance; planning and risk; fieldwork and evidence; controls; findings and reporting; the Standards and certifications; technology and analytics; and the regulatory vocabulary banking auditors meet. Two short sections follow: the terms that mean something different to external auditors, and how to learn the vocabulary in your first ninety days. For the concepts behind the terms, the what is internal audit explainer and the step-by-step process guide are the next reads; for the forty most important terms with longer definitions, the explainer’s own glossary table.
In this guide
- The function and its governance (18 terms)
- Planning and risk (18 terms)
- Fieldwork and evidence (20 terms)
- Controls (16 terms)
- Findings and reporting (16 terms)
- Standards, quality and certifications (12 terms)
- Technology and analytics (10 terms)
- Regulatory and banking vocabulary (10 terms)
- Ten pairs that get confused
- Terms that mean something different to external auditors
- The acronyms in every meeting
- Learning the vocabulary in ninety days
- Questions about audit terminology
- Related guides
The function and its governance
| Term | Meaning | In use |
|---|---|---|
| Internal audit function | The department or arrangement that performs internal auditing for an organization, whether employees, a firm or both | “The function has six people and a co-source agreement.” |
| Chief audit executive (CAE) | The head of internal audit, whatever the local title (head of internal audit, general auditor, chief auditor) | “The CAE presents to the committee quarterly.” |
| Audit committee | The board committee that oversees financial reporting, external audit and internal audit | “The committee approved the plan in December.” |
| Functional reporting | The CAE’s reporting line to the board for the function’s mandate, plan, results and the CAE’s own evaluation | “Functionally she reports to the committee chair.” |
| Administrative reporting | The CAE’s reporting line to an executive for day-to-day matters such as pay, premises and HR | “Administratively he reports to the CEO.” |
| Mandate | The authority, role and responsibilities the board grants the function | “The mandate covers all subsidiaries, including the joint venture.” |
| Charter | The board-approved document that records the mandate, independence and reporting arrangements | “The charter is reviewed every two years.” |
| Independence | Freedom of the function from conditions that threaten its ability to carry out its work without bias; an attribute of its position | “Reporting to the CFO would impair independence.” |
| Objectivity | The individual auditor’s unbiased attitude; evidence over relationships | “She declared an objectivity impairment because she had worked in that unit.” |
| Impairment | A condition that compromises independence or objectivity in fact or appearance; must be disclosed | “The impairment was disclosed and a different lead assigned.” |
| Three Lines Model | The IIA’s model of roles: management (first line), oversight functions such as risk and compliance (second), internal audit (third), under the governing body | “Compliance is second line; we test them.” |
| Assurance | An engagement in which the function reaches an independent conclusion for the board and management | “It was an assurance engagement with a rating.” |
| Advisory (consulting) | An engagement providing advice or assistance at management’s request without an assurance conclusion | “The system design review was advisory; no rating.” |
| Co-sourcing | Supplementing the in-house function with a firm’s people for skills or capacity | “We co-source the penetration testing.” |
| Outsourcing | A firm performing the whole function, with the organization retaining accountability | “Audit was outsourced until they hired a CAE.” |
| Private session | The committee’s meeting with the CAE without management present | “She raised the accepted risk in private session.” |
| Annual opinion | The CAE’s overall statement on the adequacy of governance, risk management and control, given in many functions once a year | “The annual opinion was ‘generally adequate with exceptions’.” |
| Reliance | Using another assurance provider’s work instead of performing it, after evaluating that work | “External audit placed reliance on our SOX testing.” |
Planning and risk
| Term | Meaning | In use |
|---|---|---|
| Audit universe | The inventory of everything the function could audit: processes, units, systems, programs, risks | “The universe has 61 entities.” |
| Auditable entity | One item in the universe, defined so it can be scoped and rated | “Route cash is an auditable entity; Depot 4 is not.” |
| Risk assessment (annual) | The scoring of the universe on risk factors to decide the plan | “The risk assessment moved inventory to high.” |
| Risk factor | One dimension in the scoring model: financial exposure, complexity, control environment, time since last audit | “Change is weighted 15 percent.” |
| Inherent risk | Risk before considering controls | “Inherent risk is high because drivers handle cash.” |
| Residual risk | Risk remaining after controls | “Residual risk is medium given the reconciliations.” |
| Risk-based plan | The schedule of engagements chosen by assessed risk and approved by the board | “It is a risk-based plan, not a rotation.” |
| Cycle (coverage cycle) | The rule mapping ratings to frequency: high annually, medium every two years, low every three | “Low entities are on a three-year cycle.” |
| Reserve | Hours held back in the plan for emerging risks and requests | “The cyber audit came out of the reserve.” |
| Engagement | One audit, review or advisory project with defined objectives and scope | “Eight engagements this year.” |
| Objective (engagement) | The question the engagement will answer | “Objective: are collections complete and deposited intact?” |
| Scope | The boundaries: processes, locations, systems, period in and out | “Scope excludes the acquired depots this year.” |
| Scope limitation | A restriction on the work (access denied, data unavailable) that must be reported | “The report notes a scope limitation on the legacy system.” |
| Criteria | The standards the subject is measured against: policies, laws, frameworks, good practice | “Criteria are the cash policy and the segregation standard.” |
| Planning memo | The document recording objectives, scope, criteria, risks, approach, budget and team | “The planning memo was approved on the 14th.” |
| Work program | The list of procedures to be performed to meet the objectives | “Step 7 of the work program tests independence.” |
| Budget (hours) | The hours allocated to the engagement | “Budget 520, actual 548.” |
| Risk and control matrix (RCM) | The table linking risks to the controls that address them and the tests of each | “The RCM has twelve controls.” |
Fieldwork and evidence
| Term | Meaning | In use |
|---|---|---|
| Fieldwork | The evidence-gathering stage: walkthroughs, testing, analytics, interviews | “Fieldwork runs weeks three to six.” |
| Kickoff (opening meeting) | The first meeting with the auditee to explain objectives, scope and logistics | “The kickoff is Monday with the depot director.” |
| PBC list (provided by client) | The request list of documents and data the auditee supplies | “Item 12 on the PBC list is still outstanding.” |
| Walkthrough | Tracing one transaction through a process end to end to confirm how it and its controls operate | “The walkthrough showed the approval step is skipped on weekends.” |
| Narrative | A written description of a process as it operates | “Update the narrative; the system changed.” |
| Population | The complete set of items from which a sample is drawn | “Population: 3,012 reconciliations.” |
| Sample | The items selected for testing | “Sample of sixty, five per depot.” |
| Attribute sampling | Sampling to estimate the rate at which a control operated (yes/no per item) | “Attribute sampling at 95 percent, 10 percent tolerable.” |
| Monetary unit sampling (MUS) | Sampling in which each dollar has an equal chance of selection, so large items are more likely chosen | “MUS with a $134,600 interval.” |
| Judgmental sampling | Non-statistical selection based on risk or knowledge | “Twenty judgmental items on top of the statistical sample.” |
| Tolerable deviation rate | The maximum rate of control failure the auditor will accept and still rely on the control | “Tolerable rate 10 percent.” |
| Exception / deviation | A sampled item where the control did not operate as designed | “Fourteen deviations in sixty.” |
| Test of design | Evaluating whether a control, if operated as described, would address the risk | “Design is adequate; operation is not.” |
| Test of operating effectiveness | Evaluating whether the control operated as designed over the period | “Operating effectiveness failed at nine depots.” |
| Substantive testing | Testing the outcome (balances, transactions) rather than the control | “We confirmed seventy balances substantively.” |
| Reperformance | The auditor redoing the control or calculation independently | “We reperformed the reconciliation.” |
| Evidence (sufficient, reliable, relevant) | Information that supports a conclusion; it must be enough, trustworthy and on point | “Inquiry alone is not sufficient evidence.” |
| Workpaper | The documentation of work performed and evidence obtained, enough for a reviewer to reperform it | “Workpaper D-3 has the test.” |
| Tick mark | A symbol recording a specific procedure performed on an item | “Legend: a agreed, b verified independence.” |
| Review note | A reviewer’s comment on a workpaper requiring a response before clearance | “Three review notes open on D-3.” |
Controls
| Term | Meaning | In use |
|---|---|---|
| Control | An action, device or process that reduces a risk: an approval, a reconciliation, a system restriction | “The control is the manager’s review.” |
| Preventive control | Stops an error or fraud before it happens | “Segregation is preventive.” |
| Detective control | Finds an error or fraud after it happens | “The reconciliation is detective.” |
| Corrective control | Fixes the problem once detected | “The exception process is corrective.” |
| Key control | A control whose failure would leave a significant risk unmitigated | “Only key controls are tested for SOX.” |
| Compensating control | A control that mitigates a risk when the intended control is absent or weak | “The regional review is a compensating control.” |
| Entity-level control | A control that operates across the organization rather than in one process: tone, oversight, policies | “The code of conduct is an entity-level control.” |
| Segregation of duties (SoD) | Dividing a transaction’s steps so no one person can both commit and conceal an error | “SoD conflict: the same user creates vendors and pays them.” |
| Manual control | Performed by a person | “Manual approval on the form.” |
| Automated control | Performed by a system without human intervention | “Three-way match is automated.” |
| IT-dependent manual control | A manual control relying on a system report | “The review of the exception report is IT-dependent.” |
| IT general controls (ITGC) | Controls over access, change and operations of systems that application controls depend on | “ITGCs are tested annually.” |
| Application control | A control inside a system over a specific process: edit checks, matching, calculations | “The duplicate invoice check is an application control.” |
| Management review control | A control in which a manager reviews information for reasonableness | “Management review controls need evidence of what was reviewed.” |
| Control owner | The person accountable for a control’s operation | “The depot manager is the control owner.” |
| Control environment | The tone, structures and accountability that underpin all other controls (COSO’s first component) | “Weak control environment at the acquired units.” |
Findings and reporting
| Term | Meaning | In use |
|---|---|---|
| Finding (observation, issue) | A documented gap between condition and criteria; functions vary on whether “observation” means a lesser finding | “Five findings, two high.” |
| The five Cs | Condition, criteria, cause, consequence, corrective action: the structure of a complete finding | “The five Cs are all there except cause.” |
| Condition | What was found | “Condition: 14 of 60 reconciliations not independent.” |
| Cause (root cause) | Why the gap exists, as opposed to the symptom | “Root cause: single-administrator staffing.” |
| Consequence (effect) | The risk or cost created by the gap | “Effect: diversion would go undetected.” |
| Recommendation | The auditor’s proposed corrective action | “Recommendation: route reconciliations to regional finance.” |
| Management action plan | Management’s committed response: action, owner, date | “Action plan due 31 March, owner the controller.” |
| Rating (finding) | The severity assigned: high, medium, low | “Rated high for pervasiveness.” |
| Rating (overall) | The conclusion on the area: satisfactory to unsatisfactory, or effective to ineffective | “Overall rating Unsatisfactory.” |
| Closing meeting | The meeting at the end of fieldwork where findings are discussed and facts agreed | “Facts were agreed at the closing meeting; ratings were not.” |
| Executive summary | The one-page statement of conclusion, rating, key findings and actions at the front of the report | “Directors read the executive summary only.” |
| Risk acceptance | Management’s documented decision not to remediate a finding | “The COO accepted the risk on statements; it was escalated.” |
| Escalation | Raising an unresolved matter to a higher authority, ultimately the board | “Escalated to the committee under Standard 11.5.” |
| Follow-up | Tracking agreed actions to their due dates | “Follow-up shows four actions past due.” |
| Issue validation | Testing that an action is implemented and effective before closing the issue | “Validation found the control operating; issue closed.” |
| Issue log (tracker) | The register of all findings and actions with status | “The log shows 31 open actions.” |
Standards, quality and certifications
| Term | Meaning | In use |
|---|---|---|
| IIA | The Institute of Internal Auditors, the profession’s global body, founded 1941 | “IIA guidance says…” |
| Global Internal Audit Standards (GIAS) | The IIA’s mandatory standards, effective January 2025: five domains, fifteen principles, fifty-two standards | “Standard 9.4 requires a risk-based plan.” |
| IPPF | The International Professional Practices Framework, the structure that organized the Standards and guidance from 2009; the 2017 Standards within it were replaced by GIAS | “The manual still cites IPPF standard numbers.” |
| Topical Requirement | A mandatory IIA requirement for assurance engagements on a specific topic (cybersecurity, third parties, organizational behavior, resilience) | “The Topical Requirement applies because cyber is in scope.” |
| Conformance | Meeting the requirements of the Standards; assessed as generally conforms, partially conforms or does not conform | “Partial conformance on 12.2.” |
| QAIP | Quality assurance and improvement program: the function’s own quality system | “The QAIP includes annual self-assessment.” |
| External quality assessment (EQA) | Independent assessment of conformance at least every five years | “EQA scheduled for FY28.” |
| Methodology (manual) | The function’s documented policies and procedures for its work | “The methodology manual has eleven chapters.” |
| Due professional care | The care and skill of a reasonably prudent auditor, calibrated to the engagement | “Due care required us to extend the sample.” |
| Professional skepticism | A questioning mindset; evidence over assertion | “Skepticism means we confirm, not just ask.” |
| CIA | Certified Internal Auditor, the IIA’s three-part global certification | “She passed CIA Part 3 in May.” |
| CPE | Continuing professional education hours required to maintain a certification | “Forty CPE hours a year for the CIA.” |
Technology and analytics
| Term | Meaning | In use |
|---|---|---|
| Data analytics (audit analytics) | Testing populations with queries and scripts rather than samples | “Analytics found 41 duplicate payments.” |
| Full-population testing | Applying a test to every item rather than a sample | “Overrides were tested across the full population.” |
| Continuous auditing | Automated, frequent testing producing exceptions on a schedule | “Continuous auditing runs AP tests weekly.” |
| Continuous monitoring | The same technique performed by management as a control | “That is monitoring, not auditing; management owns it.” |
| Information produced by the entity (IPE) | System reports and data the auditee provides, whose reliability must be tested before reliance | “We tested the IPE parameters.” |
| Audit management system | Software holding the universe, plan, workpapers and issue log | “The system enforces reviewer sign-off.” |
| GRC platform | Governance, risk and compliance software used by the second line, sometimes shared with audit | “Risk uses the GRC platform; we have the audit module.” |
| SOC report (SOC 1, SOC 2) | A service auditor’s report on a vendor’s controls, relied on instead of auditing the vendor directly | “The payroll provider’s SOC 1 Type 2 covers the period.” |
| User access review | Periodic confirmation that system access matches roles | “The quarterly access review missed 96 leavers.” |
| End-user computing (EUC) | Spreadsheets and other user-built tools used in controls and reporting | “212 EUCs, 31 Tier 1.” |
Regulatory and banking vocabulary
| Term | Meaning | In use |
|---|---|---|
| Examiner | A supervisory agency’s staff member examining a regulated institution | “The examiners asked for our model risk report.” |
| MRA / MRIA | Matter requiring attention / matter requiring immediate attention: supervisory findings issued by the Federal Reserve and OCC | “The MRA on liquidity stress testing closed after validation.” |
| Consent order | A formal enforcement action agreed with a regulator requiring specified remediation | “The consent order requires an independent review.” |
| Independent testing | Internal audit’s periodic test of the anti-money-laundering program required by regulation | “Independent testing is annual.” |
| Model validation | Independent review of a model’s soundness and performance, required by model risk guidance | “Validation is overdue on the deposit model.” |
| Three lines (in banks) | Business (first), risk and compliance (second), internal audit (third), with supervisors expecting each to be independent of the previous | “Second line owns the risk appetite statement.” |
| Risk appetite statement | The board’s statement of the amount and type of risk it is willing to accept | “The appetite statement sets a 30-day survival horizon.” |
| Key risk indicator (KRI) | A measure that signals a change in risk before a loss | “Uninsured deposit outflow is a KRI.” |
| Issue validation (regulatory) | Internal audit’s testing of remediation of supervisory findings before the bank reports them closed | “Validation memo sent to the examiners.” |
| Sound practices / supervisory guidance | Non-binding regulator documents setting expectations that examinations nonetheless test against | “The 2010 liquidity statement is guidance, and examiners expect it.” |
Ten pairs that get confused
Some terms are learned wrongly because they travel in pairs that sound alike. The ten pairs below cause most of the vocabulary corrections a reviewer makes in a new auditor’s first files, and getting them right early saves a year of review notes.
| Pair | The distinction |
|---|---|
| Independence vs objectivity | Independence is the function’s position (reporting lines, charter); objectivity is the individual’s state of mind. A function can be independent while an auditor on it has an objectivity impairment. |
| Finding vs exception | An exception is one sampled item where a control failed; a finding is the conclusion drawn from exceptions (and other evidence) that a control is deficient. Fourteen exceptions produced one finding. |
| Design vs operating effectiveness | Design asks whether the control would work if performed; operating effectiveness asks whether it was performed over the period. A well-designed control can fail operation, and a badly designed one cannot be rescued by perfect operation. |
| Walkthrough vs test | A walkthrough traces one item to understand the process; a test examines a sample or population to conclude on effectiveness. Walkthroughs do not support operating conclusions. |
| Inherent vs residual risk | Before controls vs after controls. Plans should follow residual risk. |
| Follow-up vs validation | Follow-up tracks whether actions are due or done; validation tests whether the done action actually works. Issues close on validation. |
| Continuous auditing vs continuous monitoring | The same automated tests, performed by internal audit (auditing) or by management as a control (monitoring). Who owns the exceptions decides which it is. |
| Co-sourcing vs outsourcing | A firm supplementing the in-house function vs a firm performing the whole function. Accountability stays with the organization in both. |
| Assurance vs advisory | A conclusion the board can rely on vs advice at management’s request. Advisory work over an area constrains later assurance over it. |
| KPI vs KRI | A performance indicator measures how well something is going; a risk indicator signals a change in exposure before a loss. Sales growth is a KPI; customer concentration is a KRI. |
Terms that mean something different to external auditors
The two professions share a vocabulary the way British and American English do: the same words, with meanings that have drifted apart enough to cause real misunderstandings in a meeting.
Internal auditors who came from public accounting, and auditees who deal with both, trip over a handful of shared words. Materiality for an external auditor is a quantitative threshold tied to the financial statements; internal auditors use it loosely to mean “matters”, and should say “significance” when they do. Audit risk in external audit is the risk of an unqualified opinion on misstated statements, decomposed into inherent, control and detection risk; in internal audit the same words usually mean the risk of an entity being audited, which the audit risk guide untangles. Deficiency in SOX work has a three-level classification (deficiency, significant deficiency, material weakness) judged by effect on the financial statements; an internal audit finding’s rating is judged against the organization’s own appetite and criteria. Substantive procedures test balances in external audit; internal auditors use the term for any test of an outcome rather than a control. Management letter is the external auditor’s list of control observations to management; internal audit’s equivalent is simply the report. And independence for an external auditor is a legal and ethical standard with prohibited services and rotation rules; for an internal auditor it is an organizational position protected by reporting lines. The internal vs external audit guide covers the differences in role; the four functions guide the differences from SOX, compliance and ERM.
The acronyms in every meeting
Acronyms are the fastest way to feel excluded in a first audit meeting and the easiest part of the vocabulary to fix, because there are only about twenty that matter everywhere. Say the full phrase when you write them in a report for the first time, because the committee member reading it may not know them either.
Beyond the terms defined above, a short set of acronyms appears in most audit conversations. AML: anti-money laundering. BCP and DR: business continuity plan and disaster recovery. CAE: chief audit executive. COSO: the Committee of Sponsoring Organizations of the Treadway Commission, author of the internal control and ERM frameworks. CCM: continuous controls monitoring. EQA: external quality assessment. ERM: enterprise risk management. GIAS: Global Internal Audit Standards. GRC: governance, risk and compliance. ICFR: internal control over financial reporting. ITGC: IT general controls. KPI and KRI: key performance and key risk indicators. MUS: monetary unit sampling. PBC: provided by client. QAIP: quality assurance and improvement program. RCM: risk and control matrix. RCSA: risk and control self-assessment, the second line’s structured self-rating of controls, which the RCSA guide covers. SoD: segregation of duties. SOX: the Sarbanes-Oxley Act. TOD and TOE: test of design and test of operating effectiveness. New auditors should keep their own list; every function adds a dozen local ones (system names, report codes, committee abbreviations) that no glossary can anticipate.
Learning the vocabulary in ninety days
Nobody arrives knowing this vocabulary, and the auditors who learn it fastest are not the ones who read the most; they are the ones who use the words early and accept correction.
The vocabulary is learned fastest by using it under correction. Read your function’s methodology manual in the first week, because it defines the local meanings (whether “observation” is a lesser finding, what the rating scale is called) that override any glossary. Read the last three reports the function issued and the workpapers behind one of them, with this glossary open; the terms appear in context and the context fixes them. Ask the meaning of any term you do not know in the moment, once, and write it down; the only embarrassing question is the one you ask twice, and senior auditors remember who asked and who guessed. Keep a running list of the local acronyms and system names. Use the precise term in your own workpapers from the start (deviation, not error; condition, not finding; population, not data), because reviewers correct vocabulary before anything else and the corrections stop once the habit forms. And read the step-by-step process guide and the job description guide, which put the terms in the order you will meet them. By the end of the first engagement most of this glossary will be yours; the regulatory vocabulary takes a year and a bank.
Questions about audit terminology
What is the difference between a finding and an observation?
It depends on the function. Many use the words interchangeably; others reserve “observation” for a lower-severity matter or an improvement opportunity that does not carry a rating. Check the methodology manual; the distinction is local, not universal.
What does “exception” mean in an audit?
A sampled item where the control did not operate as designed (also called a deviation). Exceptions are investigated before they are counted; some turn out to be test errors or explained anomalies, and only the confirmed deviations affect the conclusion.
What is the difference between inherent and residual risk?
Inherent risk is the risk before any controls are considered; residual risk is what remains after controls. Audit plans should be driven by residual risk, otherwise the function audits its best-controlled areas because they have the largest flows.
What does PBC stand for?
Provided by client: the list of documents and data the auditee is asked to supply, inherited from public accounting vocabulary. Many internal audit functions now call it the request list.
What is the difference between assurance and advisory work?
Assurance engagements reach an independent conclusion, usually with a rating, for the board and management. Advisory engagements provide advice or assistance at management’s request without a conclusion, and the function records safeguards so it can still audit the area later.
What are the Global Internal Audit Standards?
The IIA’s mandatory professional standards, effective January 2025, organized in five domains, fifteen principles and fifty-two standards. They replaced the 2017 Standards and the Code of Ethics, and sit alongside the Topical Requirements for specific subjects.
Related guides
- What is internal audit? — the concepts behind the terms.
- The internal audit process step by step — the terms in the order you meet them.
- What does internal audit mean? — purpose and vocabulary.
- The internal auditor job description — what the role expects you to know.
- Internal audit vs external audit — the shared words with different meanings.
- Internal audit vs SOX vs compliance vs ERM — the four functions’ vocabularies.
- The Global Internal Audit Standards mapped — every standard by number.
- The five Cs of audit findings — the finding vocabulary in depth.
- Internal audit workpapers — the documentation vocabulary.
- Attribute sampling and monetary unit sampling — the sampling vocabulary with arithmetic.
- What is a control? — the control vocabulary.
- Understanding audit risk — the term with two meanings.
- MRAs, MRIAs and consent orders — the banking vocabulary.
- Types of internal audits — the engagement vocabulary.
- The CIA exam hub — where the vocabulary is tested.
Leave a Reply