The illustrative scenario
A distributor with frequent supplier changes should test vendor creation and payment approvals together.
This is a planning illustration, not a client story or a promised result. Your transaction facts, entity and applicable rules can produce a different recommendation.
Identify what needs deciding
Internal audit should target the processes with the highest operational and control risks.
A report without action owners or follow-up dates rarely changes the control environment.
Write the question in business terms and separate what you know from assumptions. The adviser should explain which missing facts could materially change the proposed approach.
Gather evidence for the decision
Prepare procedures, access records, transaction populations and management concerns.
Build a dated record of the facts and explain any inconsistent records. Keep originals and identify the source of each estimate; forecasts and actual financial results should not be presented as the same thing.
Turn the assessment into an action plan
Assess risk, agree tests, validate findings and assign corrective actions with owners.
Define processes covered, sampling, site visits and follow-up testing rather than promising every risk is eliminated.
For each action, agree its owner, dependency and completion evidence. Obtain approval before a material decision is implemented and plan for possible requests for additional records.
Check the result and continuing responsibilities
Maintain the risk assessment, findings register, management responses and follow-up evidence.
How are findings prioritised and how will remediation be retested?
Review what remains outside the assignment, including future compliance and recordkeeping. Request advice tailored to the actual facts rather than using this illustration as an instruction to file or transact.
How to use this resource
