Internal Audit Checklist

Audit Planning

□ Annual audit plan developed
□ Risk assessment completed
□ Audit universe defined
□ Resources allocated properly
□ Audit schedule published
□ Stakeholder input gathered
□ Regulatory requirements considered
□ Previous findings reviewed
□ Emerging risks identified
□ Budget approved
□ Tools and technology ready
□ Team assignments made

Audit Preparation

□ Audit objectives defined
□ Scope clearly determined
□ Criteria established
□ Background research completed
□ Prior audit reports reviewed
□ Process documentation gathered
□ Key contacts identified
□ Preliminary analytics performed
□ Risk areas prioritized
□ Audit program developed
□ Work papers organized
□ Timeline established

Fieldwork Execution

□ Opening meeting conducted
□ Interviews performed
□ Process walkthroughs completed
□ Testing procedures executed
□ Samples selected appropriately
□ Evidence collected properly
□ Observations documented
□ Issues identified clearly
□ Root causes analyzed
□ Recommendations developed
□ Work papers reviewed
□ Quality assurance performed

Control Assessment

□ Control environment evaluated
□ Risk assessment reviewed
□ Control activities tested
□ Information systems assessed
□ Communication evaluated
□ Monitoring activities reviewed
□ Control design assessed
□ Operating effectiveness tested
□ Compensating controls identified
□ Control gaps documented
□ Remediation needs identified
□ Management awareness confirmed

Compliance Testing

□ Regulatory requirements identified
□ Policy compliance tested
□ Procedure adherence verified
□ Legal compliance confirmed
□ Contract terms reviewed
□ Industry standards checked
□ Ethical guidelines followed
□ Code of conduct compliance
□ Authorization levels verified
□ Segregation of duties confirmed
□ Documentation requirements met
□ Reporting obligations fulfilled

Risk Evaluation

□ Inherent risks identified
□ Control risks assessed
□ Detection risks evaluated
□ Residual risks calculated
□ Risk appetite considered
□ Risk tolerance evaluated
□ Emerging risks identified
□ Risk mitigation reviewed
□ Risk monitoring assessed
□ Risk reporting evaluated
□ Risk culture observed
□ Risk governance reviewed

Finding Development

□ Issues clearly described
□ Criteria referenced properly
□ Condition documented fully
□ Cause identified accurately
□ Effect/impact quantified
□ Risk rating assigned
□ Recommendations practical
□ Management action plans obtained
□ Implementation dates agreed
□ Responsible parties identified
□ Follow-up procedures defined
□ Escalation process clear

Report Writing

□ Executive summary prepared
□ Objectives stated clearly
□ Scope defined properly
□ Methodology described
□ Findings prioritized appropriately
□ Recommendations actionable
□ Management responses included
□ Appendices organized
□ Distribution list confirmed
□ Report reviewed thoroughly
□ Quality review completed
□ Final report issued

Communication

□ Stakeholders identified
□ Communication plan developed
□ Progress updates provided
□ Issues escalated timely
□ Draft report discussed
□ Management responses obtained
□ Disagreements resolved
□ Final meeting held
□ Report distributed properly
□ Presentation prepared
□ Board reporting completed
□ Lessons learned shared

Follow-Up Process

□ Action plans tracked
□ Implementation monitored
□ Progress reports received
□ Evidence of completion gathered
□ Effectiveness evaluated
□ Residual risk assessed
□ Re-testing performed
□ Status reports prepared
□ Escalation procedures followed
□ Management updated regularly
□ Closure criteria met
□ Final status documented

Quality Assurance

□ Audit standards followed
□ Independence maintained
□ Objectivity demonstrated
□ Professional skepticism applied
□ Documentation standards met
□ Supervision adequate
□ Review process effective
□ Quality metrics tracked
□ Customer satisfaction measured
□ Continuous improvement pursued
□ Best practices adopted
□ Benchmarking performed

Professional Development

□ Training needs assessed
□ CPE requirements met
□ Skills gaps identified
□ Development plans created
□ Certifications maintained
□ Industry knowledge current
□ Technology skills updated
□ Soft skills developed
□ Knowledge sharing practiced
□ Mentoring provided
□ Performance feedback given
□ Career development supported