Internal audit: definition, process and steps

In management control, the implementation of improvement processes is necessary within

of a company. For this, there is internal audit, an essential activity. It is part of
a process of improvement for the company and helps the entity to achieve its
objectives. Depending on the needs and resources, it may focus on certain services or on
the entire range of services of the organization. Here is a guide to better understand the stakes
of an internal audit and the steps to implement it.

What is an internal audit?

The internal audit, also called 'first-party audit', is a process that consists of
provide an entity with assurance of control over its operations and advice for the
optimizer.
Internal audit can be carried out in all companies, public or private, regardless of
regardless of their size. It is conducted by professionals, the 'internal auditors', and responds to
international standards. It is part of a global improvement approach to the
quality. He operates in a methodical and independent manner while being attached to the committee
from audit and the general management of the company.

What are the objectives of internal audit?

The internal audit aims to verify, control, and evaluate in order to provide improvement areas.
business process. Depending on the needs and resources of the entity, it can be conducted in
once or several times. It allows auditing of the different practices in all services
of the company, those at the headquarters, like subsidiaries.

Optimization of governance
Conducting an internal audit helps an organization or a company achieve the
goals set by evaluating the effectiveness of the means implemented. It therefore aims to improve the
the company's performance by measuring the risk management processes,
surveillance and governance. The internal audit aims to assist service team
generals in the efficient execution of their responsibilities. It also checks that reality
of terrain corresponds to the external image that the company wishes to project, in order to organize the
services according to the principles displayed by the brand.

Improvement of control procedures

The internal auditor performs a function of controlling the modes of operation and
of the organization of a company. This is a verification of internal control procedures.
existing in the company. Through this process analysis, it highlights the possible
malfunctions of supervisory, monitoring, and verification activities in
the intrinsic organization of society.

Improvement of risk management

The mission of the internal auditor is to ensure that the risks incurred are properly managed.
managed and anticipated. It aims to determine whether the procedures are properly established by the
hierarchy, known and respected by the employees. It allows to anticipate potential
future problems and their consequences. Internal audit thus helps to protect the company and
to increase its operational performance.
How to conduct an internal audit?
Define the objective of the internal audit
The internal audit allows for the assessment of the effectiveness of the means implemented to achieve the
normative reference. At the end of this, the company will have a clear vision of
improvements to be made and strengths to capitalize on.
The first step is therefore to determine a goal. Generally speaking, the internal audit
is based on four main objectives: to verify compliance with a framework and to detect the
non-conformities
capitalize on strengths.

Choose the listeners

The success of an audit depends on the choice of its auditor.
In an internal audit, the auditor is an integral part of the company's staff. He must be
objective, independent and have a global vision of the company and its trades.
Moreover, the auditor must master the procedures and methods related to the audit. This is about
also to provide him with all the information necessary for the proper conduct of the internal audit.
Namely, provide him with the management system standards, the specifications of
products and processes of the company.
It is also essential that the auditor demonstrates certain qualities, such as
impartiality, professional conscience, confidentiality, and independence.
He must also show openness and neutrality. Indeed, he should not be
negative, critical or engaging in discussions of a contentious or personal nature.

Prepare the audit

This step is essential, as it determines the overall approach to successfully accomplishing the mission.
efficiently.
First of all, it is about defining the services and activities to be audited, but also
determine the frequency and duration of the interviews.
It is also during this phase that it is necessary to inform the people who will be
audited. Moreover, during this interview, it is important to establish a positive relationship by
de-dramatizing the issue of the audit and establishing a climate of trust that inspires confidence in the audited
to collaborate.
During the preparation of the internal audit, the auditor reviews the documents that are provided to him.
have been provided, in order to better understand and analyze the overall functioning of the company.
It may involve normative references, previous audit reports, and manuals.
quality.

Conduct the internal audit

It is now time to conduct the audit. To begin with, it is advisable to organize a
opening meeting to present the audit plan, to remind the objectives and to present
the listeners.
Then, it is appropriate to conduct individual interviews. To do this, the questionnaire used
must cover all study subjects. The QQOQCP method can be useful in order to validate the
Information on all dimensions of the problem. It is also essential for the auditor.
to go to the workplace of the audited person to observe them in their environment.
During the closing meeting, the audit results are presented by identifying the various
major non-conformities, sensitive points, the proposal for improvement
strong points to capitalize on.
It is important not to lose sight of the fact that the objective of the audit is to evaluate while moving towards a
continuous improvement approach. It is therefore important to end on a positive note.
to motivate the audited person to want to improve.

Implement the corrective actions

Once the weaknesses and non-compliant elements have been identified, the auditor must list the
recommended actions to optimize them.
Following the management's agreement, he will establish an action plan containing the various tasks to be carried out.
carry out, the human and financial resources to allocate, as well as the implementation timeline.
However, care must be taken not to skip steps in the implementation of actions and
allow a period of adaptation for the different participants.

Monitor the effectiveness of the actions undertaken

It is the auditor's mission to implement the various corrective actions.
These will be verified, either through an additional audit or through various indicators.
such as customer feedback, internal feedback, case studies, or performance indicators
associated with the action.
A follow-up report can also be written and delivered to the stakeholders.

What are the roles of the internal auditor?

During an internal audit, the audit team takes on different roles to help...
the improvement of the internal organization of the company.

The investigation and verification work

Every internal audit begins with an information-gathering phase. The auditor starts with
collect all the necessary documents for the study of the audited activity. The organizational chart and the
job descriptions, activity statistics, or previous studies and audits are just as
writings on which his first analysis will be based. The auditor will then begin his activity.
through the reading and verification of these sources. He will then conduct a sequential analysis of
all operations and procedures to audit. This first part will end with
the development of an audit work program allowing for the completion of its part
field practice.

The realization of the entity's audit

The auditor is present in the structure to identify the risks incurred by the
collaborators and analyze the management of those. It therefore begins with the definition and the
description of all existing positions within the activity. It must then respond to the
questions: who, what, where, and how. So that risk prevention and their control are
executives, it is necessary for information to flow well within the entity. The auditor will
So develop a diagram to check the relevance and efficiency of this circulation.

To collect the necessary field information, the internal audit is based on interviews.
of collaborators and their hierarchy. These hearings are the foundations of the procedure
of the audit. To be effective, they must be conducted without preconceived notions and with objectivity. The auditor
the intern must also adapt to their audience so that they do not feel any reluctance to
he talks. After the interviews and the collection of all useful information, the auditor
will develop the internal control questionnaires that will allow for subsequent verification of
process in place.
The internal auditor must act with adaptability and flexibility in order to carry out their audit.
harmony with the circumstances and the imperatives of the field.

The audit report: writing and content

The audit report will have a strong impact on the company. It is a kind of guide for conducting
future actions. The auditor has a duty of means and not of result: he advises, but
does not put into application. His report must therefore be readable, useful and effective. It is written from
in a clear, objective, factual, and impartial manner, in a language that allows managers to
understand and act with full knowledge of the causes.
The interests of the report lie mainly in signaling the processes or areas to
improving and revealing new risks. But it also defines the procedures for
internal checks based on the strengths and successes of the company. It contains
various information including:
the presentation of the terminology used;
the presentation of the team of auditors;
the assessed documents and interviewed individuals;
the observed facts;
major non-conformities, sensitive points, strengths;
the recommendations issued.

For these recommendations to be well understood and accepted by the greatest number
They must be written while respecting certain criteria.

Positive recommendations: they must be based on the strengths of

the company and demonstrate how they can serve as a basis for improvements to
bring.
Specific recommendations: both on information concerning non-
compliances observed only on the improvements to be made.
Brief recommendations: avoid any superfluous elements that could interfere with the
good understanding of the proposed instructions.