Define the starting point and the outcome
Internal audit should target the processes with the highest operational and control risks.
Tell the adviser whether this is a new engagement, a transfer from another provider or a correction of earlier work. Identify open questions and the decision-maker who can approve assumptions and provide missing evidence.
The service workflow
Assess risk, agree tests, validate findings and assign corrective actions with owners.
The steps below describe the existing service workflow. Confirm their applicability and current portal requirements before acting; the order and supporting evidence can change with the entity or case.
Step by step
- 1
Risk assessment
- 2
Audit plan
- 3
Testing
- 4
Report & action plan
Where your approval is needed
Approve key facts and calculations before a filing or report is finalised. Ask for a readable explanation of assumptions, unresolved differences and any choices with continuing consequences. For assurance work, management preparation and independent professional judgement remain distinct.
How are findings prioritised and how will remediation be retested?
How to manage delays and queries
A report without action owners or follow-up dates rarely changes the control environment.
A useful status update names the outstanding item, its owner and the next action. Missing records, portal queries and third-party review can affect completion. Avoid treating an indicative service timeline as a guaranteed regulator decision.
What to retain when the work is complete
Maintain the risk assessment, findings register, management responses and follow-up evidence.
Confirm future responsibilities and record-retention arrangements in writing. Keep a copy of the final deliverables and know who controls access. If work continues monthly, agree the next reporting or compliance cycle before closing the current one.
How to use this resource
