Every internal audit follows the same arc, whatever its subject: it is selected because of risk, planned so that the work answers a question, performed by gathering evidence against criteria, evaluated into findings, communicated in a report, and followed up until the fixes are proven. A beginner who understands the arc stops being surprised by what happens next, knows what their work in week three is for, and can tell when an engagement has gone wrong. This guide walks the seven stages one at a time, with the inputs, activities, outputs, roles, durations and pitfalls of each, then adds the week-by-week timeline of a typical engagement, the complete list of documents produced, who does what, what a first-year auditor actually does at each stage, how the process varies by type of audit, and a worked example traced from the annual plan to the validated fix.
Two guides bracket this one. The what is internal audit explainer covers the function’s purpose, objectives and vocabulary; the fieldwork guide goes deep on the stage where most of the hours are spent. The Global Internal Audit Standards govern the process in Domain V (Principles 13 to 15) and in the planning and quality standards of Domain IV; the Domain V guide gives the standards one by one, and references below point to them.
In this guide
- The seven stages at a glance
- Stage 1: annual planning
- Stage 2: engagement planning
- Stage 3: fieldwork
- Stage 4: evaluation and findings
- Stage 5: reporting
- Stage 6: follow-up and validation
- Stage 7: quality and learning
- A week-by-week timeline for a 500-hour audit
- Every document the process produces
- Who does what: a RACI for the engagement
- What a first-year auditor does at each stage
- How the process varies by type of audit
- How the stages connect: the hand-offs and what breaks them
- Ten habits that make the process work
- A worked example: route cash, plan to validated fix
- Questions beginners ask about the process
- Related guides
The seven stages at a glance
| Stage | Question it answers | Main output | Share of engagement hours | Standards |
|---|---|---|---|---|
| 1. Annual planning | What should we audit this year? | Risk-based audit plan | Function-level, not engagement | 9.4 |
| 2. Engagement planning | What exactly will this audit answer, and how? | Planning memo, work program, announcement | 15 to 20 percent | 13.1 to 13.6 |
| 3. Fieldwork | What is actually happening? | Workpapers with evidence and test results | 45 to 55 percent | 14.1, 14.6 |
| 4. Evaluation | What does the evidence mean? | Finding sheets with ratings | 10 percent | 14.2 to 14.5 |
| 5. Reporting | Who needs to know, and what will change? | The report with management’s actions | 10 to 15 percent | 15.1, 11.2 to 11.5 |
| 6. Follow-up and validation | Did the fixes happen and do they work? | Validation memos; closed issues | Separate budget, 5 to 15 percent of the plan | 15.2 |
| 7. Quality and learning | How well did we do, and what changes next time? | Review records; self-assessment; measures | Built into every stage | 8.3, 12.1 to 12.3 |
Stage 1: annual planning
Beginners meet the plan as an assignment (“you are on the route cash audit starting in March”) and rarely see how it was made. Understanding stage 1 matters anyway, because the plan carries the engagement’s purpose and budget, and both constrain everything you will do.
Engagements do not start with the auditor; they start with the plan. Each autumn the function refreshes its audit universe, the inventory of everything it could audit, scores each entity on risk factors, interviews executives about what has changed and what worries them, and builds a plan the audit committee approves. The risk-based auditing guide explains the scoring and the plan guide shows a finished plan. For the beginner, two things matter. The engagement you are assigned has a reason: a risk score, a management concern, a regulatory requirement or a long gap since the last audit, and that reason should shape what you look for. And the plan has a budget for your engagement in hours, which is the constraint every later decision is made within.
Stage 2: engagement planning
Planning turns an entry on the plan into a question the audit will answer. The sequence: understand the area (read prior reports, policies, process documents and management’s own metrics; hold a kickoff with the process owner, covered in the opening meeting guide); assess its risks (what could stop this area meeting its objectives, which controls exist against each, how strong do they look; the engagement risk assessment guide works one through); set objectives and scope (the specific questions, the processes, locations, systems and period in and out, and the criteria the area will be measured against); and write the planning memo and the work program, the list of procedures that will produce the evidence. The announcement letter and the first request list for documents go to the auditee at the end of planning; the kickoff and notification templates show both.
Planning typically takes 15 to 20 percent of the engagement’s hours and is where most failed audits fail. Three errors recur: scope so wide the team can only skim (the fix is to let the risk assessment cut it), criteria never written down (so findings are argued about forever), and a work program copied from last time that tests the controls that were there in 2023 rather than the ones that exist now. A good test of a planning memo: could a competent auditor who has never seen the area pick it up and know what to do on Monday?
Stage 3: fieldwork
Fieldwork is the gathering of evidence, and it consumes about half the hours. It has a rhythm. Walkthroughs first: trace a transaction through the process end to end with the people who perform it, confirming the understanding from planning and the controls as they really operate (the walkthrough guide and the walkthrough vs test guide explain why this is not yet testing). Design evaluation next: would each control, operated as described, address the risk? Operating tests then: select samples or run analytics over populations to see whether controls operated across the period (the design vs operating effectiveness guide); substantive tests where the question is about outcomes rather than controls (confirmations, recalculations, observation). Documentation throughout: every procedure recorded in a workpaper that a reviewer can follow and a stranger can reperform, with tick marks recording what was done to each item.
Fieldwork has its own management: a weekly status to the process owner (no surprises, Standard 13.1), a running list of potential findings discussed with owners as they arise, a budget tracked against hours, and a decision rule for exceptions (the test exceptions guide: investigate, extend the sample, or conclude). The fieldwork guide covers all of it, including the week-by-week plan and the exit criteria that tell the team when fieldwork is finished rather than merely stopped.
Stage 4: evaluation and findings
Evaluation is where auditors earn their title. Testing produces facts; evaluation decides what they mean, how much they matter and what should change, and it is the stage most beginners find hardest because it requires judgment rather than procedure.
Evaluation turns test results into judgments. For each control tested, the team concludes whether it is designed adequately and operating effectively; for each gap, it builds a finding with the five Cs: the condition observed, the criteria it fails, the cause (found through root cause analysis, not assumed), the consequence (quantified where possible) and the corrective action. Each finding is rated against the function’s written criteria (the severity ratings guide), and the pattern of findings produces the overall conclusion on the engagement objective. Evaluation overlaps with fieldwork; findings are drafted as they are confirmed, not after. The stage ends at the closing meeting, where every finding’s facts have been agreed with the process owner even where the rating has not.
Stage 5: reporting
The report is the product, and the how to write an audit report guide gives the nine-step method: assemble from the finding sheets, decide the conclusion and rating, write a one-page executive summary that leads with the conclusion, build each finding from the five Cs, rate and defend each rating, obtain management’s action plans with owners and dates, handle disagreement and any accepted risk, edit for the reader, and review before the chief audit executive signs and the report is distributed. The target from closing meeting to issue is ten to fifteen working days in most functions. The template and the anatomy guide show the document; the presenting to the audit committee guide covers what happens when the report reaches the room that approved the plan.
Stage 6: follow-up and validation
A report changes nothing by itself; the agreed actions change things, and only when they are implemented. Follow-up is the tracking of every action to its due date, with reminders and escalation of overdue items to the committee; validation is the testing of the remediated control before the issue is closed (Standard 15.2). Validation is an engagement in miniature: a design review of the new control, an operating test over enough instances to show it works, and a memo that says closed, partially closed or not closed with the evidence. The issue validation guide gives the method, the validation workpapers guide the documentation, and the life of a finding guide the economics of why this stage, the most often underfunded, produces the most value per hour. In regulated firms, validation of supervisory findings is itself examined, and the regulatory findings guide explains the standard examiners apply.
Stage 7: quality and learning
Quality is not a stage that happens after the others; it is built into each. Every workpaper is reviewed by someone other than its preparer (Standard 12.3), with review notes raised and cleared before the report issues. Every engagement closes with a short retrospective: budget versus actual, what the plan missed, what the auditee said in the satisfaction survey, what the methodology should change. Periodically the function assesses itself against the Standards and, at least every five years, is assessed externally; the QAIP playbook and the preparing for an external assessment guide cover that layer. For the beginner, quality shows up as the review comments on your workpapers, and the fastest way to grow is to treat each comment as a lesson about evidence rather than a criticism of effort; the review notes guide is written for both sides of that exchange.
A week-by-week timeline for a 500-hour audit
A 500-hour process audit with a team of two (a senior leading, a staff auditor) and a manager reviewing part-time runs about nine to ten weeks of elapsed time. The timeline below is typical; real engagements slip in fieldwork, which is why the status meeting in week five exists.
| Week | Stage | Activities | Hours | Milestone |
|---|---|---|---|---|
| 1 | Planning | Read prior reports and policies; request documents; interview the process owner and two staff; draft the risk assessment | 45 | Kickoff meeting held |
| 2 | Planning | Finalize objectives, scope, criteria; write the planning memo and work program; manager approves; announcement letter and request list issued | 40 | Planning memo approved |
| 3 | Fieldwork | Walkthroughs of the process at the main locations; design evaluation; populations obtained and reconciled; samples selected | 70 | Walkthroughs documented |
| 4 | Fieldwork | Operating tests begin; analytics run over full populations; first potential findings discussed with owners | 75 | First findings confirmed |
| 5 | Fieldwork | Testing continues; status meeting with the owner and the manager; budget check; scope adjusted if needed | 75 | Mid-point status |
| 6 | Fieldwork | Remaining tests; exceptions investigated; follow-up requests; workpapers completed and reviewed | 70 | Fieldwork exit criteria met |
| 7 | Evaluation | Finding sheets finalized with cause and quantified effect; ratings proposed; closing meeting | 45 | Closing meeting; facts agreed |
| 8 | Reporting | Draft report assembled; executive summary written; management responses requested with a five-day turnaround | 35 | Draft to management |
| 9 | Reporting | Responses incorporated; manager and CAE review; edits; report issued; committee summary prepared | 30 | Report issued (target: within 15 working days of the closing meeting) |
| Later | Follow-up | Actions tracked to due dates; validation testing scheduled as actions complete; retrospective held | 15 plus validation budget | Issues closed on evidence |
Every document the process produces
Beginners are often surprised by how much of an audit is documents. The table lists every document a well-run engagement produces, who writes it and where the template lives on this site. Together they are the engagement file, which should let a reviewer, an external assessor or a regulator reconstruct the audit without talking to the team.
| Document | Stage | Author | Purpose | Template or guide |
|---|---|---|---|---|
| Planning memo | 2 | Senior / lead | Objectives, scope, criteria, risks, approach, budget, team | Planning memo template |
| Engagement risk assessment and risk-control matrix | 2 | Lead | Risks to controls to tests | RCM template |
| Work program | 2 | Lead | Procedures to perform, with references to results | Work program guide |
| Announcement letter and request list | 2 | Lead | Notify the auditee; request documents and data | Notification and kickoff templates |
| Walkthrough documentation | 3 | Staff | The process as it operates, with controls identified | Walkthrough template |
| Test workpapers | 3 | Staff | Population, sample, procedures, results, conclusion per control | Workpaper example |
| Sampling memo | 3 | Staff / lead | Why this sample, this size, this method | Sampling memo template |
| Status reports | 3 | Lead | Progress, issues, budget to the owner and manager | Covered in the fieldwork guide |
| Finding sheets | 4 | Staff / lead | The five Cs, evidence references, rating rationale | Five Cs guide |
| Closing meeting minutes | 4 | Lead | Facts agreed, disagreements noted, next steps | Closing meeting guide |
| Audit report | 5 | Lead; CAE approves | Conclusion, findings, management actions | Report template |
| Issue log entries | 5 to 6 | Lead; function administrator | Every action with owner, date and status | Issue log template |
| Validation memos | 6 | Validator | Evidence that each action is implemented and effective | Validation workpapers |
| Review notes and clearance | All | Reviewer; preparer | Supervision evidence | Review notes guide |
| Retrospective | 7 | Lead | Budget, lessons, methodology changes | Covered in the QAIP playbook |
Who does what: a RACI for the engagement
| Activity | Chief audit executive | Audit manager | Engagement lead (senior) | Staff auditor | Process owner |
|---|---|---|---|---|---|
| Select the engagement and set the budget | Accountable | Responsible | Informed | Informed | Consulted |
| Planning memo and work program | Informed | Accountable (approves) | Responsible | Contributes | Consulted |
| Walkthroughs and testing | — | Reviews | Accountable | Responsible | Provides access and evidence |
| Findings and ratings | Consulted on high ratings | Accountable | Responsible | Drafts | Consulted on facts |
| Closing meeting | Attends for high-risk engagements | Attends | Leads | Attends | Participates |
| Report | Accountable (signs) | Reviews | Responsible (writes) | Contributes | Provides responses |
| Follow-up and validation | Reports to the committee | Accountable | Responsible or assigns | Performs validation tests | Implements actions; provides evidence |
| Quality review and retrospective | Accountable | Responsible | Contributes | Contributes | Completes satisfaction survey |
What a first-year auditor does at each stage
Job descriptions say “assist with engagements”; here is what that means. In planning, you read the prior report and the policies before anyone asks, build the document request list from the work program, and take notes in the kickoff that become the walkthrough’s starting point. In fieldwork, you own specific controls end to end: obtain the population, reconcile it to a control total so you know it is complete, select the sample by the method in the sampling memo, perform the procedures, record each item with tick marks, investigate exceptions before escalating them, and conclude on each control in writing. In evaluation, you draft finding sheets for the exceptions you found, with the condition and criteria complete and your best attempt at cause and effect, and you attend the closing meeting to hear how the lead presents them. In reporting, you check every number in the draft against the workpapers and draft the appendix of test results. In follow-up, you perform validation tests on last year’s actions, which is some of the best training available because you see what a finding becomes. And throughout, you clear review notes promptly and keep a list of what each one taught you. The job description guide describes the role formally, and the interview question bank shows what employers expect you to know about the process by the time you are hired.
How the process varies by type of audit
The seven stages hold for every assurance engagement; the emphasis shifts with the type, and the types of internal audits guide classifies fifteen. The main variations a beginner will meet are below.
| Type | What changes in the process | Guide |
|---|---|---|
| Operational or process audit | The standard arc above; criteria often have to be agreed because no framework covers the process | Operational audit criteria |
| SOX or ICFR testing | Scope is set by management’s key-control inventory; testing follows interim, roll-forward and year-end cycles; findings are evaluated as deficiencies under a prescribed framework | SOX 404; deficiency evaluation |
| IT audit | Walkthroughs include configuration review; testing is often of automated controls (test of one with change evidence) and access lists; frameworks such as COBIT or NIST supply criteria | ITGC primer; testing automated controls |
| Compliance audit | Criteria are the law or regulation; testing is file-based and checklist-driven; findings cite the requirement | BSA/AML independent testing |
| Advisory engagement | No assurance conclusion or rating; scope agreed with the client; output is advice; independence safeguards recorded | Assurance vs advisory |
| Follow-up or validation | Stages 2 to 5 compressed into a short engagement per issue; the criteria are the original finding and the agreed action | Issue validation |
| Continuous auditing | Fieldwork becomes a scheduled script; evaluation is exception triage; reporting is periodic summaries | Continuous auditing |
How the stages connect: the hand-offs and what breaks them
The stages are not boxes; each produces something the next consumes, and most engagement problems are hand-off problems. The table names the hand-off, what is passed and the failure that appears later when the hand-off is poor. Beginners who learn to recognize the failures can often trace a late report or a contested finding back to a specific week.
| Hand-off | What is passed | Failure if poor | Where it shows up |
|---|---|---|---|
| Plan to engagement planning | The reason the entity was selected; the hours budget; management’s concerns | The engagement tests generic controls and never addresses the specific risk that made the entity high | Committee asks why the audit did not look at the thing they worried about |
| Planning to fieldwork | Criteria, risk-control matrix, work program, request list | Testing starts without criteria; evidence requested piecemeal; auditee frustration | Week four, when findings cannot be stated against anything |
| Fieldwork to evaluation | Complete workpapers with populations, samples, exceptions and conclusions | Findings without denominators; cause guessed because the exception was never investigated | Closing meeting, when management disputes facts |
| Evaluation to reporting | Finding sheets with the five Cs and rating rationale, facts agreed | Report written from memory; facts re-argued; issue slips weeks | Report issued late and contested |
| Reporting to follow-up | Actions specific enough to validate, with owners and dates, logged | Actions that say “improve” cannot be closed on evidence; issues linger | Validation, months later |
| Follow-up to the next plan | Open issues and their age; validated results; what the area looks like now | Next year’s risk assessment ignores known weaknesses | The same finding, found again, two years on |
| Every stage to quality | Review evidence, budget data, lessons | Methodology never changes; the same overruns recur | The external assessment |
Ten habits that make the process work
Experienced auditors run the same seven stages as beginners; what differs is a set of habits that keep the stages from colliding. Write the criteria down before testing anything, because a finding is a gap between condition and criteria and you cannot describe a gap against something unwritten. Reconcile every population to a control total before sampling from it, so that the sample represents the whole and not the part someone chose to send you. Discuss each potential finding with the process owner within a day or two of finding it; surprises at the closing meeting are a sign of hoarded findings. Keep the report document open from day one and drop confirmed findings into it as you go. Record what you decided not to test and why, so that the inevitable later question has an answer in the file. Track hours weekly against the budget and raise overruns at the week-five status meeting, not at the end. Write actions with the validator in mind: an action you could not test is not an action. Clear review notes within two days and keep your own list of what they taught. Hold the retrospective even when the engagement went well, because the methodology learns only from what is written down. And read the prior report and the plan’s reason for the engagement before the kickoff; the single most common beginner error is arriving at the opening meeting knowing less about the area than the people in the room expect.
Tools help at every stage without changing the stages. Audit management systems hold the universe, the plan, the work programs, the workpapers and the issue log in one place and enforce the review trail; the software hub compares them and the selection method guide shows how to choose one. Analytics tools and plain SQL (the SQL for auditors guide) turn fieldwork samples into full-population tests. The free tools on this site cover the small jobs: the sampler for sample selection and the RCM workbench for the risk-control matrix in planning.
A worked example: route cash, plan to validated fix
MidState Beverage, the three-state drinks distributor used across this site, put route cash first in its FY27 plan: about $31 million a year collected by some 300 drivers from 4,200 cash-and-check customers at twelve depots, scored 4.6 on the function’s risk model because of weak segregation at depots and four years since the last audit. The engagement was budgeted at 520 hours for a senior and a staff auditor with the audit manager reviewing.
Planning (weeks 1 to 2) produced a memo with one objective (are collections complete, deposited intact and reconciled independently at every depot?), criteria from the cash handling policy and the segregation standard, and a risk assessment that steered the work toward reconciliation independence, override approval, handheld synchronization and customer statements rather than the cash-count procedures the previous audit had tested. Fieldwork (weeks 3 to 6) walked the process at three depots, tested a stratified sample of sixty reconciliations (five per depot), ran a full-population analytic on 37,400 overrides, selected seventy customer balances by monetary unit sampling for confirmation with twenty more chosen judgmentally, and found the staff auditor’s first exception in week four: a reconciliation signed by the person who had received the cash. Evaluation (week 7) produced five findings, two high, with the facts agreed at the closing meeting and two ratings contested. Reporting (weeks 8 to 9) issued an eleven-page report twelve working days after the closing meeting, rated Unsatisfactory, with eleven agreed actions and one accepted risk escalated to the committee. Follow-up tracked the actions through the issue log; the regional reconciliation route went live in the fourth month and its validation, scheduled in the FY28 plan, will test a sample of reconciliations across the eight single-administrator depots before the two high findings are closed. Quality recorded 548 hours against 520, attributed the overrun to the confirmation work, and changed the methodology so that confirmations are budgeted separately. The report anatomy guide shows the report, the MUS guide the sampling, and the plan guide the FY27 plan the engagement came from.
Questions beginners ask about the process
What are the steps of an internal audit?
Annual planning selects the engagement; engagement planning sets objectives, scope, criteria and the work program; fieldwork gathers evidence through walkthroughs, testing and analytics; evaluation turns evidence into rated findings; reporting communicates them with management’s actions; follow-up validates the fixes; and quality review runs through all of it.
How long does an internal audit take?
A typical process audit of 400 to 600 hours takes eight to ten weeks of elapsed time with a team of two, plus follow-up months later. Smaller reviews take two to four weeks; large integrated audits can run a quarter. The how long does an audit take guide gives ranges by type.
What is the difference between a walkthrough and a test?
A walkthrough traces one transaction to confirm how the process and its controls operate; it establishes understanding and evaluates design. A test examines a sample or a population over a period to conclude whether the control operated effectively. A walkthrough alone cannot support an operating-effectiveness conclusion.
What happens at the closing meeting?
The team presents each potential finding to the process owner, confirms the facts, hears management’s view on cause and significance, discusses possible actions and agrees the timetable for the draft report and responses. Ratings may be contested; facts should not be, because they were discussed as they arose.
What does a junior internal auditor actually do?
Owns specific controls through fieldwork: obtains and reconciles populations, selects samples, performs and documents tests, investigates exceptions, drafts finding sheets, checks the report’s numbers, performs validation tests on prior findings and clears review notes.
When is an audit finished?
When the report has issued and, later, when every agreed action has been validated as implemented and effective and the issues closed. Many functions treat report issue as the end; the Standards and the economics say validation is.
Related guides
- What is internal audit? — purpose, objectives and key terms.
- Audit fieldwork: the complete guide — the stage with most of the hours.
- How to build the internal audit plan — stage 1 in full.
- Engagement-level risk assessment — stage 2 worked end to end.
- Audit planning memo template — the planning document.
- The audit work program — the procedures list.
- Process walkthroughs — how fieldwork starts.
- Internal audit workpapers — documenting the work.
- The five Cs of audit findings — building a finding.
- How to write an internal audit report — stage 5 step by step.
- The closing meeting — where facts are agreed.
- Issue validation — stage 6.
- Review notes — stage 7 at the workpaper level.
- Types of internal audits — how the process varies.
- The internal auditor job description — the role formally.
- How long does an internal audit take? — durations by type.
- GIAS Domain V — the standards behind the stages.
- Brink’s Modern Internal Auditing by Robert Moeller: Summary and How to Use It — the common body of knowledge, part by part.
Leave a Reply