People who have never been through an internal audit often imagine it as auditors arriving unannounced and rifling through files. The reality is a structured, collaborative process with clear phases, documented evidence, and several checkpoints where management is involved. This guide walks through the full audit lifecycle, from planning and fieldwork through testing, reporting, and follow-up, so you know exactly what to expect.
What You'll Learn
You will learn the five phases of an internal audit engagement, the key artefacts at each stage (engagement letter, walkthroughs, working papers, the report), how sampling and testing actually work, what happens in the closing meeting, and a realistic week-by-week timeline for a typical audit.
The Audit Lifecycle at a Glance
A single audit engagement moves through five phases. Each produces specific outputs and each involves the area being audited. In a well-run audit, nothing should come as a surprise.
| Phase | Purpose | Key Output |
|---|---|---|
| 1. Planning | Define scope, objectives, and approach; understand the area | Engagement letter, risk-and-control matrix, audit programme |
| 2. Fieldwork | Understand how the process really works | Walkthroughs, process notes |
| 3. Testing | Gather evidence on whether controls operate | Sample tests, working papers, findings |
| 4. Reporting | Communicate results and agree actions | Draft and final audit report |
| 5. Follow-up | Confirm agreed actions are implemented | Follow-up status / closure memo |
Phase 1: Planning
Planning is where the engagement is shaped, and it is where most of the value is won or lost. The auditor confirms why this area is on the audit plan, sets the objectives and scope, and develops an understanding of the process before any testing begins.
The engagement letter
The audit formally opens with an engagement letter (sometimes called an announcement memo or terms of reference) sent to the area's management. It states the audit's objectives, scope, period covered, the auditors assigned, the expected timing, and what will be required from the team. It is paired with an opening meeting where expectations and logistics are agreed. This is the moment to surface any concerns about scope or timing, not after fieldwork has started.
Risk-and-control matrix and audit programme
The auditor maps the key risks in the area to the controls that should manage them, producing a risk-and-control matrix. From this, they build the audit programme: the specific tests to be performed for each control. The matrix often draws on the area's entries in the risk register.
Pro Tip
A tight scope is a gift to everyone. An audit that tries to cover an entire department in two weeks produces shallow results. Scoping to the two or three highest-risk processes lets the auditor test deeply enough to reach conclusions that actually hold up.
Want the full framework with worked examples?
Phase 2: Fieldwork and Walkthroughs
Fieldwork is where the auditor learns how the process works in practice, not how the policy says it works. The central technique is the walkthrough: the auditor follows a single transaction from start to finish, watching each control operate and asking the people who run it to demonstrate what they do.
A walkthrough confirms three things: that the process is understood correctly, that the controls described actually exist, and that they are designed well enough to address the risk. If a control that should exist is missing, that is already a design finding, before any sample testing has begun. Auditors document walkthroughs in process notes or flowcharts and retain evidence of the transaction they traced.
A purchase-to-pay walkthrough
The auditor selects one invoice that was paid last month and traces it backward: the payment, the three-way match against the purchase order and goods-received note, the approval against the authorisation matrix, and the original requisition. Along the way they discover that invoices under R10,000 bypass the second approver entirely. That design gap becomes a finding, and it tells the auditor to size a larger sample of low-value invoices in the testing phase.
Phase 3: Testing and Sampling
Walkthroughs confirm that a control is designed properly. Testing confirms that it operates properly, consistently, over the whole period. Because auditors cannot examine every transaction, they test a sample and infer a conclusion about the population.
Sampling
Sample size depends on how often the control runs and how much assurance is needed. A daily control needs a larger sample than a monthly one. Samples may be chosen randomly (statistical sampling, which supports a quantified conclusion) or judgementally (targeting higher-risk items). The auditor documents how the sample was selected so the test can be repeated.
| Control Frequency | Typical Sample Size |
|---|---|
| Annual | 1 |
| Quarterly | 2 |
| Monthly | 2 to 5 |
| Weekly | 5 to 15 |
| Daily / many times a day | 25 to 40 |
Types of test
Auditors use several test techniques, often in combination: inquiry (asking), observation (watching), inspection (examining documents and records), and re-performance (independently redoing the control). Inquiry alone is the weakest evidence; re-performance is the strongest. Assessing whether a control actually works is the subject of control effectiveness.
Working papers
Every test is recorded in working papers, the documented evidence that supports each conclusion. A working paper states the objective of the test, the population, how the sample was selected, what was examined, the results, any exceptions, and the conclusion. Working papers are reviewed by a senior auditor before any finding is reported, and they are what an external quality assessor inspects to confirm the audit was performed properly.
Important
A finding is only as strong as its working paper. If the evidence is not documented (who you tested, what you found, and why it matters), the finding can be challenged and dismissed in the closing meeting. Document as you go, not from memory afterward.
Phase 4: Reporting and the Closing Meeting
When testing is complete, the auditor consolidates the exceptions into findings. Each finding follows the standard structure (criteria, condition, cause, consequence, and corrective action) explained in detail in what is an audit finding. Findings are rated by severity so the reader knows what matters most.
The closing meeting
Before anything is finalised, the auditor holds a closing (exit) meeting with management to walk through the draft findings. The purpose is to confirm the facts are correct, hear management's perspective, and agree the corrective actions and target dates. This is not a negotiation over whether problems exist, because the evidence is in the working papers, but it is a genuine opportunity to correct factual errors and shape practical remediation.
The report
The findings, ratings, management responses, and an overall opinion are assembled into the audit report. The report goes to the area's management and, in summary form, to the audit committee. For how results are escalated upward, see presenting audit results to the board.
Phase 5: Follow-Up
An audit is not finished when the report is issued. It is finished when the agreed actions are implemented. Internal audit tracks each action to its due date and verifies that it was actually completed and effective, not merely marked done. How this is managed in practice is covered in tracking audit recommendations.
Follow-up closes the loop and is what turns audit from a reporting exercise into a driver of real improvement. Overdue or unimplemented actions are escalated to the audit committee, which keeps pressure on remediation and prevents findings from quietly lapsing.
Example Timeline of a Typical Audit
A focused operational audit commonly runs four to six weeks of active work, plus follow-up months later:
| Week | Activity |
|---|---|
| Week 1 | Planning: engagement letter, opening meeting, risk-and-control matrix, audit programme |
| Week 2 | Fieldwork: walkthroughs, process documentation, refine the test plan |
| Weeks 3 to 4 | Testing: sample selection, control testing, working papers, draft findings |
| Week 5 | Reporting: supervisory review, closing meeting, agree actions, draft report |
| Week 6 | Final report issued to management and audit committee summary |
| 3 to 6 months later | Follow-up: verify agreed actions implemented and effective |
Common Mistakes to Avoid
1. Skipping the walkthrough
Jumping straight to testing without understanding the process means testing controls that may not even be the right ones. Walk the process first.
2. Over-broad scope
Trying to audit everything in a fixed window produces shallow work. Scope to the highest-risk processes and test them properly.
3. Weak evidence
Relying on inquiry alone, what people tell you, without inspecting or re-performing leaves findings easy to dispute.
4. Surprising management at the report stage
A finding that first appears in the final report, never discussed in the closing meeting, breeds resistance. Share findings as they emerge.
5. Treating issuance as the end
Without disciplined follow-up, agreed actions stall and the same issues reappear next year. The audit ends at implementation, not issuance.
Summary
- An internal audit moves through five phases: planning, fieldwork, testing, reporting, follow-up
- The engagement letter and opening meeting set scope and expectations up front
- Walkthroughs confirm controls are designed well; testing confirms they operate
- Sampling and working papers turn observations into defensible findings
- The closing meeting confirms facts and agrees corrective actions before the report is final
- Follow-up, not report issuance, is where the audit actually finishes
Frequently Asked Questions
How long does an internal audit take?
A focused operational audit typically runs four to six weeks of active work, plus follow-up months later to confirm actions are implemented. Larger or more complex audits take longer, while a narrowly scoped review may be shorter.
What is the difference between a walkthrough and a test?
A walkthrough traces one transaction end to end to confirm a control is designed properly and exists. A test examines a sample of transactions to confirm the control operated consistently across the whole period. Walkthroughs check design; tests check operating effectiveness.
Why do auditors use sampling instead of checking everything?
Examining every transaction is rarely practical or necessary. By testing a representative sample and documenting how it was selected, auditors can draw a reliable conclusion about the whole population. Sample size scales with how often the control runs and the assurance required.
What are working papers?
Working papers are the documented evidence behind each test and conclusion: what was tested, how the sample was chosen, what was found, and the conclusion reached. They are reviewed by a senior auditor and are what supports every finding if it is challenged.
What happens in the closing meeting?
The auditor walks management through the draft findings to confirm the facts, hear their perspective, and agree corrective actions and target dates. It is the checkpoint before the report is finalised: facts can be corrected, but the existence of evidenced issues is not up for negotiation.
Is an audit finished when the report is issued?
No. The audit is complete only once the agreed corrective actions are implemented and verified. Internal audit follows up on each action and escalates overdue items to the audit committee. See tracking audit recommendations for how this works.
Save this guide for later
Download the PDF version to read offline or share with your team.
