The first ninety days as a staff internal auditor are disorienting in a specific way that nobody warns you about: you will be surrounded by competent people using ordinary words to mean things you cannot quite pin down, you will be handed work whose purpose is explained once and briefly, and your first workpapers will come back with more comments than content. None of this means you are failing. It is what the job looks like from the inside before the pattern forms, and the pattern forms, for almost everyone, somewhere between week eight and week twelve. This guide is the map for those weeks: what you will not understand yet and why that is normal, a week-by-week arc, the questions smart new auditors ask, the workpaper basics to master before anything else, how to survive review comments and learn from them, your first walkthrough, the daily habits that compound, the ninety-day markers that say you are on track, the mistakes that set people back, and a composite first ninety days from a small function.
It is written for the person in the seat, without the condescension that guides for beginners tend to carry, on the assumption that you are capable and simply new. Where it points to deeper material, the guides on workpaper best practices, a complete workpaper example and the 5 Cs of audit findings are the three to read in your first month, and the career map that starts where this guide ends is the internal audit career ladder.
In this guide
- What you will not understand yet, and why that is normal
- The arc, week by week
- The questions smart new auditors ask
- Workpaper basics to master first
- Review comments: how to read them, answer them and stop dreading them
- Your first walkthrough and interview
- Daily habits that compound
- Working to a budget when you have no idea how long anything takes
- What to read in the first ninety days, and what not to
- The ninety-day markers
- The mistakes that set people back
- A composite first ninety days
- Related guides
What you will not understand yet, and why that is normal
Three things will be opaque for weeks, and knowing which three helps. The first is the vocabulary, which is small but dense: control, risk, objective, assertion, population, sample, exception, finding, workpaper, tickmark, walkthrough, test of design, test of operating effectiveness. Each has a precise meaning that the people around you use without defining, and you will use them slightly wrongly for a month. The second is the “so what”: you will be asked to test whether something happened and will not yet see why it matters, because the connection between a reconciliation being signed and a company losing money runs through a chain of reasoning nobody has had time to show you. The third is the process itself, the sequence from planning to report and where your piece fits, which you will only see whole after you have been through it once, and the first engagement takes longer than ninety days in most functions.
What is not expected of you in ninety days is worth stating too. You are not expected to find a fraud, write a finding that survives a closing meeting, or know the business; you are expected to produce evidence that someone else can rely on without redoing it, to ask when you do not understand, and to get better at both visibly. The senior who reviews your work has a page of notes on it not because you are failing but because that is how the craft is transmitted, and the guide on what internal audit is and why it exists gives the “so what” the function may not have time to explain.
The arc, week by week
The ninety days divide into four phases, and the table gives for each what you will mostly be doing, the one thing to master, and the marker that says the phase is done. The phases overlap, and a function that puts you straight onto fieldwork in week one will compress the first two; the order of what to master does not change.
| Phase | What you are mostly doing | The one thing to master | The marker |
|---|---|---|---|
| Weeks 1 to 2: orientation | Reading the methodology manual, the charter and the last three reports; shadowing; setting up systems access; meeting the team | The vocabulary, as a written glossary you keep and correct | You can explain, in your own words, what a control is and what a finding is, to someone outside audit |
| Weeks 3 to 4: first assigned steps | Executing test steps someone else designed on an engagement already in fieldwork; pulling documents; ticking and tying; first workpapers | The workpaper: purpose, source, what was done, what was found, conclusion, so that a reviewer can follow it cold | A workpaper comes back with notes about substance rather than about form |
| Weeks 5 to 8: a section of your own | Owning a set of steps end to end under a senior; your first walkthrough with the senior in the room, then one alone; drafting your first exception write-up | Asking the auditee the question behind the question, and writing down exactly what you saw rather than what you were told | You run a walkthrough alone and the senior does not have to go back for anything |
| Weeks 9 to 12: contribution | Clearing your own review notes in one pass; drafting a finding in the 5 Cs; helping with the closing-meeting pack; the first engagement wraps or the second begins | Judgment about what matters: which exception is a finding, which is noise, and why | You draft a finding that the senior edits rather than rewrites, and you can say what the engagement concluded and why |
The questions smart new auditors ask
New auditors worry about asking too many questions. Seniors worry about the ones who ask none, because those are the ones whose workpapers come back unusable at the end of the week. The problem is never the number of questions; it is the kind. The questions below are the ones that mark a new auditor as someone worth investing in, and the table says when to ask each and why it lands well.
| The question | When | Why it lands |
|---|---|---|
| “What is this test trying to prove, and what would a failure look like?” | When a step is assigned | It shows you are testing an objective, not following a script; the answer tells you what to write in the conclusion |
| “What does a good workpaper for this look like? Can I see one from last year?” | Before you start the first one | Every function has a house style; copying a good example saves a week of notes |
| “I have done three of the twenty-five; can you look at one before I do the rest?” | Early in any repetitive step | It catches a method error at item three instead of item twenty-five; seniors love this question |
| “Who owns this control, and who actually performs it day to day?” | In the walkthrough | The two are often different people, and the difference is often the finding |
| “Can you show me, rather than tell me?” | Whenever an auditee describes a process | What people say they do and what the system shows are different things; the workpaper records the second |
| “What do you mean by that note?” | On any review comment you do not fully understand | Guessing at a reviewer’s meaning produces a second round of notes; asking produces one |
| “I am behind on this step by about a day; what should I drop or ask for help on?” | The moment you know, not the day it is due | Seniors can fix a schedule on Tuesday; they cannot fix it on Friday |
| “What did you find on this engagement last time, and what happened afterwards?” | During planning or your first week on it | It connects the work to consequences, which is the “so what” you are missing |
Batch the small questions and ask the large ones immediately. A running list of vocabulary and process questions, asked once a day in a five-minute slot the senior agrees to, respects their time; a question about what a test is for, or whether a method is right, is asked before another hour goes into it. And ask the auditee, not only the audit team: the accounts-payable clerk who explains how the three-way match really works has taught you more about controls than the manual, and has started the relationship that makes the next question easy.
Workpaper basics to master first
A workpaper is a document that lets someone who was not there conclude what you concluded from the evidence you gathered, and every review note you will receive in ninety days is a variation on one of five failures against that definition. Master the five and the notes fall away. Purpose: the workpaper says at the top what it is testing and why, in a sentence that ties to the engagement objective; a reviewer who has to infer the purpose from the tickmarks will write a note. Source: every piece of evidence says where it came from, who provided it, when, and how you know it is complete, since a report the auditee produced is not evidence until you know what it covers; the standard for that is in the IPE testing guide and is stricter than new auditors expect. Procedure: what you actually did, specific enough to repeat, with the tickmarks defined and used consistently. Results: what you found, item by item for exceptions, with the exception described as what the evidence shows rather than what you think it means. Conclusion: whether the objective was met, stated in a sentence that a reader could challenge, and cross-referenced to any finding.
Three habits make the five reliable. Write the purpose and the conclusion first, as a draft, before you gather anything, and fix them when the evidence changes them; it keeps the work pointed at the objective. Never leave a placeholder you intend to fill later, because later never comes and a workpaper with “TBC” in it is a review note guaranteed. And read your own workpaper as the reviewer will, cold, the next morning, before you submit it; most new auditors who do this find half their notes themselves. The complete worked example in the audit workpaper example shows every element in place; copy its shape until yours is automatic.
Review comments: how to read them, answer them and stop dreading them
Review notes are the mechanism by which the profession trains its people, and the number on your first workpapers is a measure of the craft’s distance from your starting point, not of your ability. There are three kinds, and reading which kind you have received is the first skill. Form notes ask for the house style: a reference, a tickmark legend, a date, a heading. They are quick to clear and they disappear entirely by week six if you keep a list of the ones you have received and check each new workpaper against it. Substance notes ask about the evidence: whether the source is complete, whether the procedure proves the objective, whether the exception is described accurately. They are the valuable ones, and each is a lesson about what the work is for; the response to a substance note is to fix the workpaper and to understand why, so the same note is never written twice. Judgment notes ask whether you have drawn the right conclusion, and they are the ones that feel personal and are not; the reviewer is showing you how an auditor thinks about an exception, and the response is a conversation, not a correction.
A protocol for clearing review notes
1. Read every note on the workpaper before answering any; the pattern across them is the lesson. 2. Sort them: form, substance, judgment. 3. Clear the form notes first, in one pass, and add each type to your running checklist so it never recurs. 4. For each substance note, fix the workpaper, then write a one-line response that says what you changed and, if you disagree, why, with the evidence. 5. For judgment notes, ask for five minutes with the reviewer rather than answering in writing; listen for the reasoning, then write it into the workpaper in your own words. 6. Re-read the whole workpaper cold before resubmitting, against the five basics. 7. Keep a private log of the substance and judgment notes you received, by theme; after a month it is the most accurate map of what you need to learn, and after three it is the evidence of how far you have come.
Two things not to do. Do not argue with a note in writing before you have understood it; the notes that seem wrong are usually the ones whose reasoning you have not yet seen, and the ones that are actually wrong are best raised in person. And do not take the volume personally in weeks three to six, when it peaks; every senior who reviews you received the same volume once, and the ones who write the most notes are usually the ones who care most whether you learn. The longer treatment of this, for the days when it is hard, is eight things brand-new internal auditors should know.
Your first walkthrough and interview
A walkthrough is where you follow one transaction through a process from start to finish with the people who run it, and it is the first thing a new auditor does that feels like auditing. It goes well when three things are true. You prepared: you read the process narrative or last year’s walkthrough, you know the systems’ names, and you have a list of the control points you expect to see, so that the conversation is about confirming and correcting a picture rather than building one from nothing. You watched rather than listened: the auditee describes the process as it is supposed to work, and your job is to say “can you show me that on the screen” at every step where the description and the system could differ, because the workpaper records what you saw. And you asked who, not only what: who performs the control, who reviews it, who can override it, who covers when they are away, since the answers are where segregation-of-duties findings live. Take a transaction the auditee did not choose, note the identifiers, and write the walkthrough up the same day while the screens are in your memory; the method is set out in walkthrough vs test of controls, and the difference it draws, between confirming a design and testing that it operates, is the single most useful distinction you will learn in the ninety days.
The interview manner matters more than new auditors think. Auditees are often nervous, sometimes defensive, occasionally hostile, and always busy, and the new auditor who arrives with the senior’s confidence but not the senior’s credibility can make it worse. Be curious rather than clever, thank people for their time and mean it, never say “that is a finding” in the room, and when someone tells you something that sounds wrong, ask them to show you rather than telling them it is wrong. The best new auditors leave every walkthrough with the auditee wanting to help them, and that is a skill worth more than any test step.
Daily habits that compound
Five habits, started in week one, produce most of the difference between the new auditors who are trusted with a section by week eight and those who are not. Keep a glossary, one page, corrected as you learn that a word means something slightly different from what you thought; by week six it is the function’s vocabulary in your own words. Keep a time log against the budget for every step, honestly, from day one, because budgets are how the function measures itself and the auditor who knows they are a day behind on Tuesday is the one who can ask for help. Keep the review-note log described above. Ask for feedback at the end of every week in one question, “what is the one thing to do differently next week”, and act on it visibly, because seniors invest in people who take feedback and stop investing in those who defend against it. And find the person, usually a senior two or three years ahead of you, who will answer the questions you are embarrassed to ask the manager, and buy them coffee; the profession runs on that relationship, and the guide on five key skills for internal auditors is a reasonable list of what to ask them about.
Working to a budget when you have no idea how long anything takes
Every step you are given has an hours budget, and in the first ninety days you will have no feel for whether eight hours for twenty-five items is generous or impossible. Three rules cover the gap. Ask for the budget with the assignment, and ask what the senior thinks the hard part is; the answer calibrates you faster than anything. Check your pace at a quarter of the way through, not at the deadline: if three items took three hours against a budget of eight for twenty-five, say so on day one, because the senior can change the sample, the method or the allocation in the morning and can only absorb the overrun by the evening. And record the hours honestly, including the hours that were slow because you were learning, since a function that sees new auditors take longer expects it and plans for it, while a function that sees new auditors hit every budget exactly learns to distrust the log. Budgets are the profession’s way of measuring itself, and the auditor whose log is truthful from week one is trusted with the budget by month six; the mechanics of how the plan’s hours are built, and why the senior cares, are in the internal audit plan template.
What to read in the first ninety days, and what not to
New auditors are often handed the Standards on day one and told to read them, which is roughly like handing a new driver the highway code before the car keys. Read them later. In the first ninety days the reading that pays is local and short: the function’s methodology manual, which tells you how this function does the job and is the source of most form notes; the charter, which tells you what the function is for and where its authority comes from; the current plan, so you know what is coming and why; the last three reports, which show you what a finding looks like when it is finished and what the committee sees; and last year’s workpapers for the engagement you are on, which are the house style in worked form. Alongside those, one book: the practitioner’s reference in Sawyer’s guide, read in the six-week plan that summary sets out, because it explains the reasoning behind the steps you are executing. The Standards themselves, in the form the profession uses since 2025, are worth an hour’s orientation through the Global Internal Audit Standards guide and a proper read in month four, when the words will mean something; the report format that your finding will end up in is shown in the internal audit report template, and reading it early tells you what the workpaper has to feed.
What not to read: three competing methodology books, the history of the profession’s frameworks, and the online forums where new auditors compare notes on how hard everyone is being on them. The first two are for month six; the third is for never.
The ninety-day markers
Functions rarely tell new auditors what “on track” looks like, so here is a list you can hold yourself to; nobody hits all of them, and the trend matters more than the count. Review notes per workpaper have fallen from a page to a handful, and none of the form notes recur. You have run at least one walkthrough alone and written it up the same day. You have drafted at least one exception write-up that became, or fed, a finding, in the 5 Cs, and the senior edited it rather than rewriting it. You can explain to someone outside the function what the engagement concluded and why it matters. At least one auditee would take your call. You have asked a question that changed something: the scope of a step, the sample, the interpretation of an exception. Your time log matches reality and you flagged at least one slip before it was due. You know what the next engagement is and have read its planning memo. And you have started, or booked, the first part of the CIA, which the roadmap in certifications by career stage puts in the first two years for good reason. If most of those are true at ninety days, you are ahead; if three or four are, you are on track; if none are, the problem is more likely the function than you, and the honest assessment in is internal audit a good career may help you tell the difference.
The mistakes that set people back
The mistakes are few and predictable. Hiding lateness, because the new auditor thinks it reflects badly on them, when it is the concealment that reflects badly and the lateness that is expected. Guessing rather than asking, on a method or a meaning, and producing twenty-five wrong items instead of three. Arguing with review notes before understanding them, which costs the reviewer’s goodwill faster than any error in the work. Writing what the auditee said rather than what the evidence showed, which is the most common substance note in the profession and the hardest habit to break. Calling something a finding in the room, which converts a curious auditee into a defensive one and sometimes into a complaint. Over-promising to the auditee, on timing or on what the report will say, which is not yours to promise. And sitting on a real concern, a possible fraud or a serious control failure, because you are new and might be wrong; the rule is to raise it with the senior the same day, in private, with the evidence, and let them decide, which is what the fraud red flags guide is for.
A composite first ninety days
MidState Beverage’s six-person audit function hired its staff auditor from the finance team at one of the company’s twelve depots, with no audit background and a good understanding of how route cash actually moves. The chief audit executive gave the new hire a six-week reading plan built around Sawyer’s guide, described in the Sawyer’s summary, and put them straight onto the year’s first engagement, the route cash audit, as the staff member on the reconciliation sample: sixty depot reconciliations, five from each depot, to be tested for independence of the preparer and reviewer and for evidence of the review. The ninety days that followed are the arc in this guide with the specifics filled in.
| Weeks | Assignment | What went wrong | What changed |
|---|---|---|---|
| 1 to 2 | Reading plan, methodology manual, last year’s depot rotation reports; shadowing the senior’s planning | The vocabulary: “independent” in the test step meant something narrower than the new hire assumed from depot life | A glossary, one page, corrected in the first week when the senior explained that a reviewer who could also prepare is not independent whatever their title |
| 3 to 4 | The first fifteen reconciliations, three depots; first workpapers | The workpapers recorded what the depot managers said about their review rather than what the sign-offs and timestamps showed; twenty-two review notes on the first one | The “show me” rule; sources documented; the second workpaper had nine notes, the fifth had three |
| 5 to 8 | The remaining forty-five reconciliations; the first walkthrough alone, at the new hire’s former depot | Familiarity: the new hire nearly accepted the former colleagues’ description of a control that the system showed was performed by the same person who prepared | The exception was recorded as the evidence showed; it became one of the nine depots in the report’s first High finding, and the former colleagues still took the new hire’s calls |
| 9 to 12 | Drafting the exception write-ups; a first pass at the finding in the 5 Cs; the closing-meeting pack | The draft finding said what was wrong without saying why it mattered; the senior asked for the “so what” in dollars and customers | The rewrite tied the design deficiency to the 31 million dollars of driver-collected cash a year and the Dayton loss; the senior edited two sentences and left the rest |
At ninety days the new hire had run walkthroughs alone at four depots, seen fourteen of sixty reconciliations fail and learned to describe each failure as what the evidence showed, drafted an exception write-up that survived into a High finding at nine of twelve depots, kept a time log that flagged a two-day slip in week six early enough for the senior to reallocate, and booked CIA Part 1 for month eight on the function’s reimbursement. The review-note log, kept from week three, showed the theme of the first month (“said, not shown”) gone by the third. The CAE’s assessment at the ninety-day check-in was the one this guide is built around: the new hire did not yet understand the whole engagement, could not yet scope a section, and had produced evidence the function relied on without redoing, which at ninety days is the entire job.
Related guides
Related guides
- Audit Workpaper Best Practices
- Audit Workpaper Example: A Complete Walkthrough
- The 5 Cs of Audit Findings
- Walkthrough vs Test of Controls
- How to Test Information Produced by the Entity
- Eight Things Brand-New Internal Auditors Should Know
- Five Key Skills for Internal Auditors
- Internal Audit Step by Step: A Guide for Beginners
- What Does Internal Audit Mean?
- The Internal Audit Career Ladder
- A Certification Roadmap by Career Stage
- Sawyer’s Guide for Internal Auditors: Summary and Study Notes
- New and Aspiring Auditors (category)
Leave a Reply