An audit is an independent examination of evidence that tests whether information, processes or controls are reliable and comply with applicable criteria. Its core output is an opinion or set of findings that gives stakeholders confidence in what they rely on. External audit provides an independent opinion on whether financial statements present a true and fair view, serving shareholders, lenders and regulators. Internal audit serves management and the board by evaluating risk management, control and governance processes, and it often provides advisory insight as well. The key distinction lies in who engages the auditor, who relies on the result and the scope of assurance. Both functions depend on objectivity, evidence and clear reporting.
Independence is essential because stakeholders can only rely on an audit opinion if the auditor is free from influence that could bias judgment. Threats include self-interest, such as an auditor holding a financial stake in the client, self-review, where an auditor evaluates work their own firm performed, advocacy, familiarity from long relationships, and intimidation by management. Professional codes of ethics require identifying these threats and applying safeguards, such as rotating engagement partners, separating non-audit services or having an independent audit committee approve work. For internal auditors, independence comes largely from reporting lines that reach the board or audit committee rather than the managers whose activities are being examined.
Auditors plan engagements using risk-based approaches, concentrating effort where errors or control failures would be most significant. They first identify the entity's objectives and the risks that could prevent them, including operational, financial, compliance and technology risks. Each risk is then assessed for likelihood and impact, often using a heat map or scoring model. Areas rated highest receive more testing, while low-risk areas may receive lighter or periodic coverage. For example, an internal auditor reviewing a retailer might prioritize inventory valuation and payment processing after noticing high transaction volumes and recent system changes. This approach makes limited resources go further and aligns the audit plan with what matters most to the organization.
Materiality is the threshold above which misstatements or deficiencies could reasonably influence the decisions of users of the information. External auditors set overall materiality based on a benchmark such as profit before tax or revenue, then derive performance materiality as a lower amount to reduce the risk that small errors accumulate beyond the overall threshold. Materiality also informs which accounts receive detailed testing and how findings are evaluated. Materiality is a judgment rather than a fixed rule, and it can be revised during the audit if new information changes the picture. Qualitative factors matter too, since a small misstatement can be material if it hides a covenant breach or affects executive compensation.
Audit evidence must be sufficient in quantity and appropriate in quality to support the conclusion reached. Reliability depends on the source, with evidence obtained directly by the auditor from independent parties generally stronger than information supplied by management. Documents are more reliable when originals are inspected, and external confirmations from banks or customers carry significant weight. Relevance matters as well, since evidence must relate to the assertion being tested, such as existence, completeness or valuation. Auditors also consider consistency across sources and whether contrary evidence exists. For instance, a sales figure supported by shipping records and customer confirmations is far more persuasive than one resting on a spreadsheet prepared by the sales team alone.
Sampling allows auditors to test a subset of items and infer conclusions about an entire population, which is far more practical than examining every transaction. Statistical sampling uses probability to select items and quantify sampling risk, while judgmental sampling relies on the auditor's expertise to target high-risk or unusual items. The sample size depends on risk, tolerable error, expected error and population characteristics. Auditors test selected items against source documents and record exceptions, then project the results to the population where appropriate. For example, testing a random sample of expense claims might reveal a pattern of unapproved travel, prompting broader investigation. Sampling must be designed carefully, because a poorly selected sample can miss the very problems the audit seeks to detect.
Internal controls are policies and procedures designed to provide reasonable assurance that objectives are achieved, including reliable reporting, effective operations and compliance with laws. The COSO Internal Control Integrated Framework is a widely recognized model that organizes controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. It also identifies objectives across operations, reporting and compliance. Organizations use the framework to map their controls, identify gaps and assess whether each component is present and functioning. Controls can be preventive, such as requiring approval before payment, or detective, such as reconciling bank statements monthly. Auditors evaluate both the design of controls and whether they operate consistently throughout the period under review.
Segregation of duties separates responsibilities for authorizing, recording, custodying and reconciling transactions so that no single person can commit and conceal an error or fraud. For example, the employee who approves vendor payments should not also create vendor records or reconcile the bank account. Auditors test this by reviewing organization charts, system access rights and transaction logs to identify individuals with conflicting permissions. They look for compensating controls where full separation is impractical in small teams, such as independent review of reconciliations by a manager. Weak segregation is a common and serious finding because it removes the natural checks that protect assets and the integrity of reported figures.
Auditors must consider the risk of material misstatement due to fraud, including fraudulent financial reporting and asset misappropriation. Standards emphasize professional skepticism, meaning auditors question evidence rather than accepting management's explanations at face value. Common red flags include unusually rapid revenue growth, transactions near period end, unexplained adjustments, unreconciled accounts, resistance to providing documents, frequent changes in auditors or management, and lifestyle inconsistencies among staff. The fraud triangle of pressure, opportunity and rationalization helps auditors understand motives. When red flags appear, auditors expand procedures, such as testing journal entries and interviewing personnel. Fraud findings are sensitive and must be handled carefully, with escalation to those charged with governance.
The audit committee, typically made up of independent non-executive directors, oversees financial reporting, internal controls, risk management and the audit process. It recommends the appointment of the external auditor, approves audit fees and scope, and monitors auditor independence, including the provision of any non-audit services. It reviews the internal audit charter, annual audit plan and significant findings, and it meets with both auditors privately to discuss concerns without management present. Effective committees ask probing questions, track remediation of prior findings and maintain direct channels of communication. Strong oversight helps ensure that audit functions serve the interests of shareholders and the board rather than being shaped by the executives whose performance they evaluate.
The internal audit charter is a formal document approved by the board or audit committee that establishes the function's purpose, authority, responsibility and position within the organization. It grants access to records, personnel and physical assets needed to complete engagements, and it defines the scope, which can include financial, operational, compliance and information technology activities. The charter also specifies reporting lines, typically functional reporting to the audit committee and administrative reporting to the chief executive. Professional standards, such as those issued by the Institute of Internal Auditors, require the charter to be periodically reviewed. A clear charter protects the function from being limited or redirected by management and sets expectations for stakeholders.
An external audit typically begins with client acceptance and engagement letter, where the auditor assesses integrity, competence and independence and agrees on responsibilities. Next comes planning, including understanding the business, its industry and internal controls, and setting materiality and risk assessments. Fieldwork follows, during which auditors test controls and perform substantive procedures on account balances and transactions. They evaluate misstatements identified, communicate with management and those charged with governance, and obtain representations from management. Finally, they complete review procedures, consider subsequent events and form an opinion. The report may be unmodified, or it may be modified with a qualified, adverse or disclaimer opinion where scope limitations or material misstatements exist.
IT general controls are policies and procedures that apply across information systems and support the reliable operation of application controls. They typically cover logical access management, program change management, computer operations and data backup or recovery. Auditors test these controls because automated controls, such as a system that blocks invoices exceeding a limit, are only trustworthy if the underlying system cannot be altered improperly. If general controls are weak, for example if developers can move unapproved code into production, auditors cannot rely on application controls and must perform more extensive substantive testing. Testing typically involves reviewing user access listings, change tickets and disaster recovery documentation.
Data analytics allows auditors to examine entire populations of transactions rather than relying solely on samples. Using tools that query ledgers and transaction records, auditors can identify duplicate payments, unusual journal entries posted on weekends, round-dollar amounts, gaps in invoice numbering and transactions split to avoid approval thresholds. Techniques such as Benford's law analysis can flag unusual distributions of leading digits. Computer-assisted audit techniques also enable continuous auditing, where monitoring runs regularly rather than annually. These methods improve coverage and efficiency, but they require good data quality, clear hypotheses and professional judgment, since an anomaly is only a starting point for investigation rather than evidence of wrongdoing.
A cybersecurity audit assesses whether controls protect the confidentiality, integrity and availability of information assets. Auditors typically review governance, including security policies and assigned responsibilities, and risk management processes that identify threats to critical systems. They examine access controls such as multifactor authentication and privileged account management, network security including firewalls and segmentation, vulnerability management and patching cycles, incident response planning, and security awareness training. Auditors may review vendor and third-party risk management because outsourced systems can introduce exposure. A useful audit combines documentation review with testing, such as checking whether a sample of servers has current patches and whether incident response procedures have been exercised.
Effective audit findings are typically structured around the condition found, the criteria it violates, the cause, the effect or risk, and a recommendation. This sequence helps readers understand not only what went wrong but why it matters and how to fix it. Auditors rate findings by severity, often distinguishing high, medium and low risk, so that management can prioritize. Findings should be discussed with the process owner before reports are finalized to ensure accuracy, and management responses should include agreed action plans with owners and target dates. Clear, fair and evidence-based reporting builds credibility and improves the likelihood that recommendations lead to lasting change rather than being ignored.
An unmodified opinion, sometimes called a clean opinion, states that the financial statements present fairly, in all material respects, the entity's financial position and performance in accordance with the applicable financial reporting framework. It indicates that the auditor obtained sufficient appropriate evidence and found no material misstatements that remained uncorrected. A modified opinion arises when the auditor concludes that misstatements are material or pervasive, or when evidence cannot be obtained. A qualified opinion reflects material but not pervasive problems, an adverse opinion indicates misstatements that are both material and pervasive, and a disclaimer means the auditor could not form an opinion. Readers should always consider the accompanying notes and emphasis-of-matter paragraphs, since they explain significant uncertainties.
Auditors evaluate whether there are events or conditions that raise substantial doubt about the entity's ability to continue operating for a reasonable period, typically at least one year from the reporting date. They review cash flow forecasts, debt maturities and covenant compliance, the status of major contracts, litigation and dependence on key customers or suppliers. Management is asked to assess its plans to address any concerns, such as refinancing or asset sales, and auditors evaluate whether those plans are realistic and supported. If substantial doubt remains, the financial statements must disclose it, and the auditor will typically include a going concern paragraph in the report. This paragraph signals risk to stakeholders without necessarily meaning the business will fail.
Auditors operate under codes of ethics that require integrity, objectivity, professional competence and due care, confidentiality, and professional behavior. When a client pressures an auditor to accept an aggressive accounting treatment or to reduce the scope of testing, the auditor must assess whether the pressure threatens objectivity and apply safeguards. Professional judgment involves weighing evidence, considering alternatives and documenting the rationale for conclusions so that a reasonable, informed third party could understand them. Auditors who discover wrongdoing may face obligations to escalate concerns internally and, in some jurisdictions, to report to regulators. Ethical reasoning is therefore central to the credibility of the profession, not simply a compliance exercise.
Audits provide reasonable rather than absolute assurance because of inherent limitations. Testing is based on samples rather than complete populations, and much evidence is persuasive rather than conclusive. Collusion among employees or between management and third parties can conceal fraud from auditors, and management can override controls in ways that are difficult to detect. Some misstatements involve estimates and complex judgments where reasonable people may differ. Time and cost pressures also constrain the depth of procedures. Consequently, users should not treat an audit opinion as a guarantee that the business is free from error or fraud. Understanding these limitations helps stakeholders set realistic expectations and complement audit assurance with their own due diligence.