Safety Norms: Internal, External and IT Audit

1Purpose, Scope, and Safety Principles

These norms govern how auditors protect the organization, its people, its data, and themselves during internal audits, external audit support engagements, and IT audits. They apply to employees, contractors, co-sourced staff, and anyone granted access to financial systems, records, or premises for audit purposes.

Three principles guide every rule: independence before convenience, least privilege before speed, and escalation before silence. Rules marked MUST are mandatory for all engagements. Rules marked SHOULD are recommended good practice and may be adapted through documented approval. Local law, professional auditing standards, and contract terms may impose stricter requirements, and those always prevail over these norms.

2Roles, Competence, and Accountability

The head of internal audit owns these norms and reports on their operation to the audit committee. Each engagement lead owns planning, sampling approach, reviewer assignment, and sign-off. Staff auditors own accuracy of their working papers. IT audit specialists own approval of technical testing methods on production systems. Management owns remediation of findings and must not direct auditors toward particular conclusions. Information security owns access provisioning, and legal or compliance staff own privilege decisions and regulator contact.

Competence means documented ability for the specific scope, not general seniority. Auditors without that competence must work under supervision or stay out of the task.

• MUST: Only auditors with documented competence for the scope perform IT testing, data analytics on production data, or fraud-related fieldwork.
• MUST: Each engagement records a named lead, a reviewer, and a signed independence declaration completed before fieldwork starts.
• MUST: An auditor with a conflict, such as prior operational responsibility for the area or a close personal relationship with a process owner, withdraws from that work and reports the conflict to the engagement lead.
• SHOULD: Pair junior staff with a reviewer during fraud-sensitive walkthroughs and interviews.
• SHOULD: Refresh competence each year against the internal training plan and record the outcome.

3Activities, Hazards, and Risk Assessment

Typical activities include audit planning and risk assessment, process walkthroughs, interviews with managers and staff, sampling of invoices, payroll records, journal entries, and vendor master data, extraction of ledger and transaction data, user access reviews, site visits to warehouses, branches, or data centers, and preparation of reports for management and the audit committee. The people involved include auditors, process owners, executives, external auditors, IT administrators, and vendors. The tools include analytics software, shared drives, audit management platforms, screen-sharing applications, laptops, and removable media. Environments range from finance back offices and server rooms to client sites and home offices.

Each engagement must complete a written risk assessment before fieldwork. Score each hazard for likelihood and impact on a three-point scale, multiply the scores, and treat any result of six or higher as high risk requiring a named control and owner. Local rules on monitoring employees and handling personal data vary by jurisdiction, so confirm them with the privacy officer before data collection begins.

• High: unauthorized disclosure of payroll, bank, or personal data from working papers or extracts.
• High: auditor holding excessive system access that allows changes to the records being tested.
• High: auditor tipping off a suspected fraudster through informal conversation or a premature data request.
• High: independence impaired by consulting work, self-review, or prior operational duties in the same area.
• High: management pressure to change ratings, remove findings, or delay reporting.
• High: phishing messages posing as auditors, vendors, or executives requesting credentials or changed bank details.
• Medium: inaccurate sampling or data extraction that leads to wrong conclusions.
• Medium: loss or theft of laptops, removable media, or paper files containing audit evidence.
• Medium: slips, trips, and restricted-area incidents during site visits, managed by following site escort and induction rules.

4Preventive Controls and Segregation of Duties

Segregation of duties is the core financial control safeguard in audit work. An auditor who initiates, approves, records, or corrects a transaction cannot independently test that transaction. If an auditor performs any part of a control under review, the work is classified as a self-review, disclosed in the report, and reviewed by someone without that involvement. Audit access to financial systems is read-only by default. Any write permission requires written approval from the engagement lead and the system owner, time limits, and activity logging.

Fraud prevention starts in planning. The fraud risk assessment identifies schemes relevant to the process, such as duplicate payments, vendor and employee address matches, round-dollar entries, weekend or after-hours postings, and manual overrides. Sample selection criteria are documented before results are known. Changing a sample after seeing results is permitted only with reviewer approval and a recorded reason. Interviews on sensitive matters are conducted by two people, and notes are stored in a restricted folder rather than shared drives.

• MUST: No auditor approves, posts, corrects, or deletes a transaction in an audited system.
• MUST: Every data extract is reconciled to source control totals, such as record counts and ledger balances, before analysis begins.
• MUST: Changes to samples, test results, or conclusions are logged with the reason, the preparer, and the reviewer initials.
• MUST: Auditors decline gifts or hospitality from audited parties above the organization's published limit and record any offers.
• MUST: Audit files are not shared with the audited area while fieldwork is open unless the engagement lead approves in writing.
• SHOULD: Rotate auditors across recurring high-risk areas such as payroll, treasury, and procurement to reduce familiarity risk.
• SHOULD: Use unannounced testing elements where law, policy, and contract terms allow.

5Information, Confidentiality, and IT Safeguards

Audit files frequently contain payroll records, bank account numbers, employee case files, customer identities, and security configurations. Auditors collect the minimum data needed for the test objective and document why each sensitive field is required. Confidentiality duties continue after the engagement ends. Privacy, data protection, and breach notification rules differ by jurisdiction and by sector, so the privacy officer and information security function must confirm the applicable requirements for each engagement.

IT audit work adds technical hazards. Testing scripts run against production systems can slow services or lock accounts if not scheduled and approved. Credentials used for testing must be individual, not shared, and must be removed when the engagement closes. Information security standards referenced by the audit function are jurisdiction and organization dependent, and these norms do not replace the technical standards and configuration guidance issued by the system owner.

• MUST: Working papers are stored only in the approved, access-controlled audit repository with activity logging.
• MUST: Each auditor uses a named account. Shared credentials are prohibited, and access is removed at engagement close.
• MUST: Personal and bank data in extracts are masked or tokenized unless unmasked data is essential and approved in writing.
• MUST: Laptops and removable media holding audit content are encrypted. Personal email and consumer cloud storage are not used for audit content.
• MUST: Production testing scripts are scheduled with the system owner and run only after change approval.
• MUST: Suspected phishing, unusual access requests, and requests to change payment details are reported to information security immediately.
• SHOULD: Use secure viewing rooms or restricted screens for highly sensitive records such as executive compensation or investigation files.

6Incident, Suspicion, and Escalation Procedures

Auditors must distinguish between a control weakness, a suspected fraud, a data exposure, a physical injury, and pressure or intimidation. Each category has a different owner and timeline. An auditor who suspects fraud must not investigate alone, confront the suspect, alter evidence, or discuss the matter with the people involved. The auditor records what was observed, when, and where, then escalates promptly. If the normal reporting line is conflicted, escalation goes to the audit committee chair and to legal counsel, who advises on privilege and on any referral to law enforcement through authorized channels.

Physical emergencies take priority over audit work. Follow site evacuation, first aid, and emergency contact procedures, and call local emergency services for any serious injury, fire, or threat. Do not enter restricted or hazardous areas without the required induction, escort, and protective equipment.

• MUST: Report suspected fraud or misconduct to the chief audit executive the same working day where practical, or within the timeframe set by the audit policy.
• MUST: Preserve evidence by securing copies, logging access, and never editing original records.
• MUST: Record near misses, such as access granted in error, data sent to the wrong recipient, or pressure to change findings.
• MUST: Notify information security immediately of any suspected data exposure. Breach notification duties vary by jurisdiction and are decided with legal counsel.
• MUST: Stop work and report if testing causes an unexpected system outage or data change.
• SHOULD: Hold a lessons-learned review after every escalation and update these norms where gaps appear.

7Records, Training, Monitoring, and Review

Working papers must allow an independent reviewer to understand what was tested, why, from which source, with what result, and what conclusion was reached. Records include independence declarations, access requests, sample change logs, escalation logs, and training completion records. Retention periods for audit records vary by jurisdiction and by regulated sector, so retention must follow the organization's records policy and legal advice rather than a fixed period stated here.

Training is mandatory before fieldwork, not an optional extra. Monitoring shows whether the controls work in practice. Review the norms annually and after any significant incident, audit finding about the audit function itself, or change in applicable law, professional standards, or systems.

• MUST: Each working paper shows preparer, reviewer, purpose, source data, result, and conclusion.
• MUST: Conflict declarations, access records, and escalation logs are retained according to the records policy.
• MUST: Confidentiality, fraud indicator, and escalation training is completed before fieldwork begins.
• MUST: Access exceptions and unresolved escalations are reported to the engagement lead and reviewed monthly while open.
• SHOULD: Perform a quality review of a sample of completed engagements by someone outside the team.
• SHOULD: Report key monitoring measures, such as overdue declarations, access exceptions, and repeated control failures, to the audit committee at least once a year.

Implementation checklist

• Confirm a signed independence declaration exists before fieldwork starts.
• Request read-only access and record written approval for any exception.
• Reconcile every data extract to source control totals before analysis.
• Mask personal and bank data unless unmasked access is approved in writing.
• Store working papers only in the approved, access-controlled audit repository.
• Log every change to samples, test results, or ratings with reviewer initials.
• Do not confront suspects, investigate alone, or alter original evidence.
• Escalate suspected fraud to the chief audit executive the same working day where practical.
• Report suspected phishing or payment detail change requests to information security immediately.
• Verify local standards, privacy rules, and retention periods with qualified professionals.