How to conduct an internal audit
Conduct an internal audit by defining criteria and scope, assigning an independent auditor, sampling evidence, recording findings and checking corrective actions. See a worked QueryChart process and practical steps for applying it.
Conduct an internal audit by defining criteria and scope, assigning an independent auditor, sampling evidence, recording findings and checking corrective actions.
The short version
- Plan the sample: Set scope, criteria, locations, owners and evidence sources; confirm auditor independence.
- Collect evidence: Interview staff, observe work and sample records against each criterion, noting both conformity and gaps.
- Report and follow up: Agree factual findings, assign owners and due dates, then verify action effectiveness before closure.
How to conduct an internal audit in practice
An audit tests whether a defined process meets its criteria and works in practice. A checklist alone is not evidence: the auditor needs records, interviews and observations tied to specific requirements and a clear sampling rationale.
Plan from risk and past findings, agree dates and criteria, review documents, then follow a transaction through the process. State each finding with criterion, observed evidence and gap; assign actions and verify closure separately.
See the internal audit process workflow
Step through the decisions behind how to conduct an internal audit.
Plan the sample
The programme, assigned auditor and independence check establish a credible audit before a checklist is used.
Collect evidence
Preparation and opening meeting align scope and criteria; record sampling and interviews then test actual practice.
Report and follow up
Evidence is evaluated against requirements, findings are documented and corrective action is verified before closure.
How it works
Plan the sample
Set scope, criteria, locations, owners and evidence sources; confirm auditor independence.
Collect evidence
Interview staff, observe work and sample records against each criterion, noting both conformity and gaps.
Report and follow up
Agree factual findings, assign owners and due dates, then verify action effectiveness before closure.
Mistakes to avoid
Missing the decision record
Keep the actor, decision and effective state alongside the output. An audit tests whether a defined process meets its criteria and works in practice. A checklist alone is not evidence: the auditor needs records, interviews and observations tied to specific requirements and a clear sampling rationale.
Open the worked process
Use the linked internal audit process template to adapt the workflow to your team.
Frequently asked questions
How large should the sample be?
Use risk, volume and prior issues to choose a defensible sample; record why you chose it.
Can a team audit itself?
Use an auditor independent of the work being assessed where practical.
When is an audit complete?
The report is issued when evidence and findings are agreed; findings close only after follow-up verification.