An internal audit programme sets out what will be audited, when, by whom and against which criteria.
Base frequency on risk
Audit high-risk, high-change or poorly performing processes more often.
Use competent, independent auditors
Auditors should not audit their own work and should be trained in audit techniques.
Audit processes, not departments
Follow the work across functions to find the gaps between them.
Close the loop
- Write clear, evidence-based findings
- Agree root cause and corrective action
- Verify effectiveness before closing
- Report trends to management review