Nobody teaches you the actual job.
The methodology manual has 400 pages and no advice. Your senior is booked solid. And your first review notes are coming whether you’re ready or not. This is the working introduction to internal audit — how engagements really run, from the announcement memo to the closed issue.
Get the Field Guide — $149Audit Field
Guide
Every auditor learns the real job by osmosis. Osmosis takes two years.
Your first weeks in internal audit are a fog of acronyms used casually by people too busy to define them — TOD, TOE, PBC, tickmarks, “the file.” The methodology manual defines everything and explains nothing. The prior workpapers assume you already know what good looks like. And the review notes arrive in quantities nobody warned you about, reading less like coaching and more like a verdict.
None of this means you’re behind. It means the profession transmits its real knowledge person-to-person, engagement-by-engagement, at whatever pace your particular senior has time for. The strong new auditors aren’t smarter — they got the transmission earlier.
The Internal Audit Field Guide is that transmission, compressed to forty pages and sequenced the way your first engagement will be: what audit actually is, how one runs end to end, the tradecraft around it, and a week-by-week plan for your first ninety days.
A practitioner’s decade, organized like a workpaper file.
The author is a practicing internal auditor with ten years inside large U.S. financial institutions — staff to senior manager, hundreds of engagements, thousands of review notes given and received. The guide is written the way strong audit shops write: full sentences, precise claims, evidence for everything, and reference codes throughout, because learning to follow a reference trail is part of learning the job.
From the desk behind internalauditguide.com — 300+ practitioner-written guides and the free Examination Desk tools used by working auditors.
“The polite fiction is that everyone welcomes audit. The working reality is that you arrive as an interruption and leave, if you do the job well, as a useful one.”
One of the field notes — chapter FG–01The page that will save you the most review notes.
Workpapers are the product you’re graded on, and nobody shows new auditors what a good one looks like — annotated, with the reviewer’s reading order and the standard it has to meet. Chapter FG–08 does. These aren’t mockups — the pages below are rendered live from the book itself.
8.2Review notes, and how to take them
Your workpapers will come back with review notes — questions and required fixes from your senior or manager. In your first months there will be many, and this is the system working, not failing: notes are how methodology actually gets transmitted, one correction at a time. The professional move is to clear them completely (fix the paper, don’t just reply), promptly (aging notes read as avoidance), and without relitigating the ones that merely bruise (save pushback for notes that are actually wrong — and then push back with evidence, which reviewers respect). Keep a private list of every note you receive. Within two audits you will see your own patterns; within four, the list stops growing. That list is the fastest professional development tool in this book.
Write for the stranger: purpose, source, procedure, results, conclusion — cross-referenced, tickmarked, and concluded in full sentences. Then clear your review notes like an athlete watches film.
The map: lifecycle, kickoff, and the cast
Learn the shape of one audit and you have learned the shape of all of them. The subjects change; the arc doesn’t.
An audit begins officially when the announcement memo goes to the business: what’s being audited, roughly when, by whom, and what’s needed to start. It ends — mostly — when the final report is issued. In between, the arc above plays out with remarkable consistency across industries, and each phase hands specific artifacts to the next: planning produces the scope and test plan; fieldwork produces evidence and workpapers; reporting turns validated exceptions into findings and a rated report; follow-up checks, months later, that promised fixes actually happened.
Two consequences of the shape are worth absorbing now. First, work compounds forward: a sloppy walkthrough in week two becomes a mis-scoped test in week five becomes a finding that collapses under challenge in week ten. When this guide harps on doing early steps carefully, that is why. Second, the calendar is real: the phases overlap and the report date is usually promised to the audit committee before fieldwork ends. Time you lose quietly in the middle gets found loudly at the end.
Planning feels slow (reading, meetings, a matrix nobody outside audit will ever admire), fieldwork feels like real work, and reporting feels like negotiation conducted through documents. New auditors consistently underrate the first phase and overrate the second. The veterans’ secret is that reporting is easy exactly in proportion to how careful planning was — by the end of a well-planned audit, the report mostly writes itself out of the file.
9.2The five C’s — the load-bearing skeleton
Nearly every audit shop writes findings on the same frame, whatever it calls it. Learn it as a checklist and as a diagnostic: when a draft finding feels weak, one of the five is missing or doing another’s job.
| Element | The question it answers | The standard it must meet |
|---|---|---|
| Condition | What did you find? | Specific and quantified: “7 of 25 sampled wires released without documented callback” — not “callbacks were not always performed.” |
| Criteria | What should be true? | Cited: the policy section, procedure, regulation, or control description — with a reference. No criteria, no finding; unwritten expectations get negotiated, not asserted. |
| Cause | Why did it happen? | The root, not the symptom (§9.1). This sentence determines the fix. |
| Consequence | Why does it matter? | Plausible and sized: exposure, precedent, or actual loss — stated without adjectives doing the work numbers should. |
| Corrective action | What should happen? | Aimed at the cause, proportionate to the consequence, achievable by the named owner. (In many shops management proposes it; audit assesses adequacy.) |
9.3Severity, without inflation
Findings carry ratings — high/medium/low, or numbered tiers — and the rating drives everything downstream: who must respond, how fast, and how far up the escalation travels. Methodologies frame severity as impact times likelihood, and that framing is right, but apply it with two honest checks. First, rate the risk, not the effort of the fix — a catastrophic exposure with a cheap remedy is still high. Second, resist both inflations: rating high to feel consequential, and rating low to keep the meeting friendly. Your calibration is your reputation; senior people read your ratings the way traders read a counterparty’s marks.
“I want to walk you through what we’re seeing before anything gets written. Seven of the twenty-five wires we tested don’t show a callback before release — here are the seven. First: is there evidence we haven’t seen? And if not, help me understand what’s happening on those days, because the why changes what we write.”
Facts first, invitation to correct, cause explored together. The finding that survives this conversation is a finding that survives anything.
Validate the fact, find the real cause, size the consequence, cite the criteria, and socialize early. A finding built this way is not an accusation — it’s a well-supported argument the business helped you check.
Templates: request list & walkthrough agenda
| # | Request (be specific: system, period, format) | Requested | Due | Received / status |
|---|---|---|---|---|
| 01 | Current procedure document(s) for [process], with version history | |||
| 02 | Org chart for [team], with roles performing each control | |||
| 03 | Full population extract: [system], [date range], incl. query definition and row count evidence | |||
| 04 | Prior 12 months of [reconciliation / exception report], as performed | |||
| 05 | System access list for [application], all roles, as of [date] | |||
| 06 |
One numbered list per engagement, one owner per side, refreshed at every status meeting. Anything asked in a hallway gets added here the same day — or it wasn’t asked.
- Opened with purpose, time, non-gotcha framing; confirmed recorder of notes
- Performer demonstrated on production system, normal speed, real record
- Asked the exception path: “show me one that got stuck” — noted handling
- Asked coverage: “who does this when you’re out?” — noted answer
- Asked: “what would you fix?” and “any manual steps the procedure assumes are automated?”
- Captured evidence: screenshots w/ system, record ID, date — taken live
- Read back key claims verbatim; listed mutual to-dos with dates; left door open
Notes to file within 24 hours, while memory is still evidence. Cross-reference to the RCM row this walkthrough supports.
Forty pages of that, sequenced like your first engagement.Every sample above is the real page, rendered live from the guide
By the last page, you will know:
- The whole arc of an audit — planning, fieldwork, findings, reporting, follow-up — and why work compounds forward through it.
- What a control actually is (and why a policy isn’t one): performer, trigger, expectation, evidence, follow-up.
- Design vs. operating effectiveness — the distinction the whole profession runs on, with the tests for each.
- Population-first testing — the completeness step everyone skips and every reviewer checks first.
- Workpapers that stand alone — the stranger standard, tickmarks, cross-references, and conclusions in full sentences.
- Findings on the five C’s — root cause that fixes something, severity rated on risk instead of vibes, and the no-surprises rule.
- How to clear review notes fast — and mine them into a private development log that flattens your learning curve.
- Interview craft — the five questions that earn their airtime, the three-second silence, and the exception path where risk actually lives.
- Your first 90 days, week by week — what to read, what to own, and what managers actually grade (it isn’t brilliance).
- Certifications, priced plainly — CIA, CPA, CISA, and the specialty credentials, ranked by what they actually buy you.
Sixteen chapters, sequenced like the job.
Part I gives you the lay of the land, Part II walks one audit end to end — the same arc your first engagement will follow — Part III is the tradecraft nobody writes down, and Part IV is your runway: the first 90 days and where the career goes.
The texture the methodology manual leaves out.
Throughout the guide, four kinds of tickmarked callouts carry the person-to-person knowledge: The point (the one thing to retain), Field notes (learned the slow way in real engagements), Watch out (the errors real new auditors actually make), and Say this (word-for-word language for the moments that are easy to fumble).
Here’s one — for the kickoff meeting, when the business asks the question they always ask:
“Ideally? Nothing. We scoped this because the process is significant, not because anyone suspects a problem. If things work the way they’re designed, the report will say exactly that.”
True, disarming, and it frames the engagement as evidence-driven — which you’ll spend the next eight weeks demonstrating.
For the week the badge is new — or the interview is next Tuesday.
The new hire with a start date
Read it front to back before day one and you’ll walk in speaking the language — and knowing what your manager is actually grading in month three.
The career switcher
From accounting, operations, compliance, or a Big 4 exit: the guide maps what transfers, what’s different, and how to sound fluent in the interview before you’ve done the job.
The staff auditor mid-fog
Six months in and still nodding through meetings? The testing, workpaper, and findings chapters are the explanations your senior keeps not having time for.
The manager onboarding a class
A week-one handout that answers the hundred small questions before they reach your seniors. Team licensing available via the site’s contact page.
Your first review notes are coming either way.Read it before day one and walk in speaking the language
Two years of osmosis, or forty pages now.
The knowledge in this guide is all technically free — scattered across two years of review notes, hallway corrections, and mistakes made in front of people whose opinions decide your ratings. The guide is the same transmission without the tuition: one clean read before your first engagement, then a reference you’ll open every time a test, a finding, or a review cycle pushes back.
Starting a new role? Many employers reimburse professional materials — worth one email to ask.
FAQ
I have zero audit experience. Is this over my head?
It’s written for exactly zero. Every term is defined on first use and again in the glossary, and the sequence follows your actual first engagement — you learn planning before testing before findings, the way you’ll live it.
Is it bank-specific?
The author’s decade is in financial services, and the examples lean that way — wires, reconciliations, access reviews. The craft itself (controls, testing, workpapers, findings, interviews) is industry-general; internal audit runs on the same skeleton everywhere.
Will it help me break into internal audit?
It won’t write your resume, but it does something interviews reward: it makes you fluent. Candidates who can walk the lifecycle, explain design vs. operating effectiveness, and describe what a good workpaper contains sound like they’ve done the job. That fluency is this book.
Is this CIA exam prep?
No — it’s the job, not the syllabus. It pairs well with exam prep (the concepts overlap heavily), and the certifications chapter gives you a plain-priced take on which credentials are worth your nights. But if you only want exam questions, buy a question bank.
How is this different from the free guides on this site?
The site’s articles go deep on individual topics. The Field Guide is the sequenced, designed, end-to-end course of the job — with the templates, scripts, and first-90-days plan — built to be read offline, printed, and kept on the desk. The articles are the library; this is the orientation.
When do I get it?
Instantly — the download link is on the receipt, and the receipt arrives the moment payment clears. If your start date is Monday, you can be halfway through Part I tonight.
Refunds?
Digital product, all sales final — which is why the sample pages above are rendered straight from the book itself, not mockups. What you see is exactly what the other 35 pages look like.
Your first engagement is coming either way.
Everyone in your cohort will learn this job. The only variable is whether it takes two years of review notes or one prepared evening — and which of those people your manager remembers at rating time. A hundred forty-nine dollars settles it before day one.
Get the Internal Audit Field Guide — $149
P.S. — The fastest tell of a prepared new auditor is the vocabulary: TOD versus TOE, population before sample, condition-criteria-cause. It’s two pages of the glossary — and the difference between nodding through your first team meeting and being in it.
Checkout opens this week.
The book is done; the store is being wired. Leave your email and the buy link lands in your inbox the moment it’s live.