The service-specific risk to address first
A report without action owners or follow-up dates rarely changes the control environment.
A distributor with frequent supplier changes should test vendor creation and payment approvals together.
Mistake 1: assuming the same rule applies to everyone
Internal audit should target the processes with the highest operational and control risks.
Entity type, business activities, transaction facts and the relevant period can change the answer. Before using a checklist or a headline rule, ask which facts make it applicable to you. Verify current official requirements rather than copying an old article.
Mistake 2: sending records that do not reconcile
Prepare procedures, access records, transaction populations and management concerns.
Flag mismatches and missing items before the adviser starts. Never overwrite an original record simply to make totals match. Preserve an explanation of corrections so the final position can be traced back to its evidence.
Mistake 3: confusing one task with full compliance
Define processes covered, sampling, site visits and follow-up testing rather than promising every risk is eliminated.
An incorporation, registration, return or report is a particular deliverable. Other permissions, recurring obligations and implementation work may remain. Ask for a written list of what the engagement does not cover.
What to do if work is already wrong
Preserve the original submission or report and ask for an assessment of the available correction route. Do not submit a duplicate application or ignore a communication without checking the consequences. Identify the issue, relevant period and supporting evidence.
How are findings prioritised and how will remediation be retested?
Maintain the risk assessment, findings register, management responses and follow-up evidence.
How to use this resource
