Internal, External and IT Audit

01Purpose and scope

• This manual supports the course Internal, External and IT Audit. It is written as a working reference for people who plan, perform, review or rely on audit work over financial reporting, financial controls and the information systems that produce financial data.
• The three audit types share a common goal of giving a reader of the financial statements or a governing body reasonable assurance about a specific area. They differ in who performs the work, who relies on it, and what standards govern it. Internal audit reports to the board or its audit committee and evaluates risk management, control and governance across the organization. External audit is performed by an independent firm and expresses an opinion on whether financial statements are presented fairly. IT audit examines the general computer controls and application controls that support financial processing, such as access management, change management, system operations and data integrity.
• This manual covers the activities, decisions, deliverables and roles common to all three, and it notes where practice differs. It does not replace the professional standards, engagement letters, regulatory requirements or employer policies that apply to a specific engagement. Requirements depend on jurisdiction, industry and whether the entity is publicly listed, so confirm them with the current authoritative source and with qualified professionals before acting.

02Core principles

• Independence and objectivity come first. An internal auditor should not design or operate the controls under review, and an external auditor must avoid relationships or services that impair independence. When independence is threatened, the threat should be documented and either removed or safeguarded, and the audit committee should be informed.
• Audit work is risk based. Auditors do not test everything. They identify where a misstatement, fraud, loss or system failure would matter most, then concentrate effort on those areas. A revenue cycle with complex contracts and manual adjustments usually draws more attention than a stable payroll process with strong automated controls.
• Evidence must be sufficient and appropriate. Auditors prefer evidence obtained directly from independent sources over evidence supplied by the process owner, and they test whether documents are complete and accurate before relying on them. A system generated report used as audit evidence should be checked for completeness and accuracy of the underlying data.
• Conclusions must follow from the evidence. An auditor who finds an exception should describe what was tested, what was found, why it matters and what the organization should do. Opinions that cannot be traced back to specific work papers do not hold up under review.
• Professional skepticism means questioning explanations and not accepting management representations at face value. It does not mean assuming dishonesty. A good auditor asks what would have to be true for an explanation to hold, then looks for that evidence.

03Planning and preparation

• Planning starts with understanding the entity, its business model, its financial reporting process and the control environment. For internal audit, this usually means reviewing the enterprise risk assessment, prior audit reports, open findings and recent changes in systems, staffing or strategy. For external audit, the planning stage includes assessing the risk of material misstatement at the assertion level, which means deciding which accounts, disclosures and assertions such as existence, completeness, valuation and presentation could be wrong.
• For IT audit, planning maps the IT environment that supports financial processes. This includes identifying in-scope applications, databases, operating systems, interfaces, third party hosted services and the people who administer them. A common early deliverable is an inventory of systems tied to financial reporting, with owners and a description of how data flows from source to ledger.
• The audit scope and objectives should be written down and approved. A scope statement names the entity, business units, processes, systems, locations and time period covered, and it also states what is excluded and why. Exclusions are a frequent source of later disagreement, so they need a stated rationale.
• Resource planning matters. Internal audit teams should match skills to the work, especially for data analytics and system configuration testing. External engagement teams need to plan for specialists when they audit complex estimates, tax positions or cyber controls. A realistic timetable should allow time for management to respond to requests, which often takes longer than expected.
• Engagement letters or audit charters set the authority and expectations. An internal audit charter, approved by the board, grants access to records and staff. An external audit engagement letter defines responsibilities of management and the auditor, including management's responsibility for the financial statements and for maintaining internal control.

04Recommended workflow

1. 1
   : Confirm the audit objective, scope and risk assessment with the sponsor. Record the business owners, the systems in scope and the reporting deadline. Agree on how scope changes will be approved during fieldwork.
2. 2
   : Document the process and controls. Walk through each key process from initiation to recording in the ledger, usually with the process owner present. Prepare process narratives or flowcharts and mark the points where a control is supposed to operate, such as approval of a purchase order or reconciliation of a bank account.
3. 3
   : Identify key controls and design the testing approach. For each key control, decide whether to test design only, operating effectiveness, or both. Choose the nature, timing and extent of tests. Inspection of documents, reperformance of a calculation, observation of a process and data analysis each provide different levels of assurance.
4. 4
   : For IT controls, test the general computer controls first. Review user access provisioning and removal, privileged access, change approval and testing before production, job scheduling and backup procedures. Pull system generated user listings and compare them with human resources records and approved access requests. Note whether the listing itself was validated for completeness.
5. 5
   : Perform data analytics where they add value. Full population analysis can find duplicate payments, journal entries posted on weekends, entries posted by users outside their normal role, or unusual round amounts. Analytics identify candidates for testing, and each flagged item still needs supporting evidence before it is called an exception.
6. 6
   : Perform substantive procedures for external audit or detailed testing for internal audit. Confirm balances with third parties, examine subsequent receipts, recalculate estimates such as allowances for doubtful accounts, and compare disclosures with source records. Record the sample selection method and the population size for each test.
7. 7
   : Evaluate exceptions. Determine whether an exception is an isolated error, a control deviation or a systemic failure. Look for compensating controls and for root causes. For external audit, consider whether the exception points to a material misstatement, which may require expanding testing or discussing adjustments with management.
8. 8
   : Draft findings and discuss them with management before the report is issued. Each finding should state the condition, criteria, cause, effect and recommendation. Management responses should include owners and target dates. Auditors should not finalize a finding without giving management a chance to supply facts they have not seen.
9. 9
   : Report to the appropriate audience. Internal audit reports go to the audit committee and senior management, with a summary of significant findings and the status of previously reported issues. External auditors communicate with those charged with governance, and reports may include an opinion, a management letter or communication of significant deficiencies. Confirm the report distribution list before issuing.

05Quality checks, risk controls and compliance

• Quality review should happen before any report leaves the audit team. A reviewer should check that the scope matches the engagement letter, that work papers support each conclusion, that sample selections are documented, and that exceptions are described consistently across the report and the underlying files. Many organizations assign a second reviewer who did not perform the testing.
• Internal audit functions commonly follow the Global Internal Audit Standards issued by the Institute of Internal Auditors, which cover ethics, purpose, governance, managing the function, performing engagements and communicating results. External audit in the United States follows auditing standards set by the Public Company Accounting Oversight Board for issuers and generally accepted auditing standards from the American Institute of Certified Public Accountants for nonissuers. Other jurisdictions have their own standards, so the applicable framework should be confirmed with the current authoritative source.
• The COSO Internal Control Integrated Framework is widely used to design and evaluate internal control over financial reporting in the United States, and it organizes control into five components and seventeen principles. Section 404 of the Sarbanes-Oxley Act requires management and, for larger public companies, the external auditor to assess internal control over financial reporting. Those requirements apply to specific entity types, so an organization outside that scope may use the framework voluntarily or may have different obligations.
• For IT controls, the COBIT framework from ISACA is often used to map control objectives to business requirements. The NIST Cybersecurity Framework is used by many organizations to organize security controls, though it is not an audit standard in itself. Auditors should state which framework they used as criteria so the reader knows what the conclusion is measured against.
• Audit independence rules restrict some services, such as preparing financial statements or designing controls for an audit client. Internal auditors should not take on management responsibilities that would compromise future objectivity without clear disclosure and safeguards. Where privacy or data protection laws apply, auditors should limit access to personal data to what the engagement requires and handle extracts under the entity's data policy.
• These guidelines are general. Regulated and high-risk areas such as tax, financial instruments, anti-money laundering, and public company disclosures require qualified professional judgment, approved procedures and, where relevant, formal authorization from the appropriate regulator or board. Nothing in this manual replaces those.

06Collaboration and documentation

• Audit work depends on cooperation from process owners, finance staff, system administrators and sometimes vendors. Agree early on a single point of contact for information requests and a log that tracks each request, the date it was made, the person responsible, and the date fulfilled. Unanswered requests are one of the most common causes of late reports.
• Work papers should be complete enough that an experienced auditor who did not perform the work can follow what was done and reach the same conclusion. Each work paper should show the objective, the source of the data, the procedure performed, the results, the preparer and the reviewer. Source data extracts should be saved with the query or parameters used to generate them.
• Document the reasons for judgment calls. If the team decided to sample 25 items instead of 60 because the control was automated and passed general computer control testing, record that logic. If an exception was excluded because it related to a prior period, record why it was not part of scope.
• Coordinate between internal and external audit where reliance is intended. External auditors may use internal audit work when they assess the work as adequate and objective, which requires the external auditor to evaluate the function, the scope of the work and the quality of documentation. Share plans and results early so duplicate testing can be avoided and the reasons for any reliance are on file.
• Retention and confidentiality matter. Keep work papers according to the organization's retention schedule and the requirements of applicable rules. Restrict access to sensitive information such as payroll data, personal identifiers and unreleased financial results.

07Measures and continuous improvement

• Internal audit functions track indicators such as the percentage of planned audits completed, the time from fieldwork start to draft report, the proportion of findings accepted by management, and the number of open findings past their target dates. These measures show whether the function is delivering value, but they should be read together. A high acceptance rate can mean the team is raising trivial points, and a low rate can mean findings are poorly explained.
• Track the status of remediation. Findings are only useful if actions are completed and verified. Internal audit should retest closed findings, not simply accept management's statement that the action is done. A common practice is to verify remediation through a sample of transactions or a retest of the control after a reasonable operating period.
• External audit quality is often evaluated through inspection reviews by regulators or peer reviews within the profession. Whether a given review applies depends on the jurisdiction and the type of client, so the current requirements should be confirmed with the authoritative source.
• IT audit indicators include the number of users with excessive privileges, the share of changes that lacked documented approval, the time to remove access after a termination, and the number of unresolved high severity vulnerabilities. Trend data is more useful than a single snapshot. Benchmarks vary by industry and size, so set targets from the organization's own history and risk appetite.
• Lessons learned should feed the next planning cycle. Revisit the risk assessment after significant findings, system changes, acquisitions or leadership changes. Update analytics scripts and checklists when a test proved unreliable or when a new data source became available.

08Common mistakes and how to prevent them

• Accepting a system report without testing its completeness is a frequent error. A user access listing that omits terminated employees or service accounts will make access review look clean when it is not. Ask how the report was generated, compare totals with a second source, and document the test.
• Testing design and operation loosely is another common problem. An auditor may observe a reconciliation being performed once and conclude that the control operates effectively all year. Operating effectiveness needs a sample across the period, and the sample size should reflect the frequency and risk of the control.
• Writing findings that describe symptoms rather than causes leads to recommendations that do not fix anything. A finding that says reconciliations were late should go further and identify whether the cause was a staffing gap, an unclear procedure, or a system limitation.
• Scope creep and scope gaps both cause trouble. Expanding an engagement during fieldwork without updating the scope document creates confusion about what was tested. Leaving out a key interface between a billing system and the general ledger can hide the largest risk in the process.
• Relying on management summaries without evidence weakens the audit. Management may describe a control accurately but apply it differently in practice. Inspect the actual records, and when a summary and the records differ, document the difference.
• Allowing independence to erode is easy to miss. An internal auditor who helps implement a new system and then audits it later has a conflict. Review assignments for conflicts at the start and whenever roles change.

09Practical checklist

• Confirm the audit objective, scope, exclusions and approval record before fieldwork begins.
• Identify the key processes, key controls and the systems that support them.
• Check that the population used for sampling is complete and that the report generation method is documented.
• Select the testing approach for each control, including whether design, operation or both will be tested.
• For IT controls, test user access, privileged access, change management, job scheduling and backup procedures.
• Record the sample method, population size, sample size and the reason for each selection.
• Evaluate every exception for cause, effect, pattern and compensating controls before drafting a finding.
• Write findings with condition, criteria, cause, effect and recommendation, then discuss them with management.
• Obtain a documented management response with owners and target dates.
• Have a reviewer who did not perform the work check conclusions against the evidence.
• Confirm report distribution with the audit committee or those charged with governance.
• Track remediation and retest closed findings before marking them complete.
• Confirm applicable standards and legal requirements with the current authoritative source and with qualified professionals.

★Learning sources

• Micro Degree: Internal, External and IT Audit
• Micro Degree: Accounts Payable Management
• Micro Degree: Bank Reconciliation Operations
• Micro Degree: FinTech Fundamentals