Internal Audit

What it does

Internal Audit is designed to plan and execute risk-based internal audits with independence. It uses the platform event log for full-population testing where data allows, AI-drafted workpapers under auditor review, and findings with tracked follow-ups that link to GRC issues.

Planning

The audit universe lists auditable processes, entities, locations, systems and vendors with risk scores drawn from Enterprise Risk and GRC. An annual or rolling plan prioritises engagements by risk, resources and budget hours, and is approved by the audit committee. Engagements carry scope, objectives, team, timeline, status and budget against actual hours.

Fieldwork

Template work programmes per process link test steps to controls. Workpapers are structured with evidence references and reviewer sign-off, and become immutable once signed. Document requests (PBC) go to auditees with due dates, uploads and reminders. Sampling supports statistical and judgemental methods with the seed recorded, drawing samples from platform data. At GA, full-population analytics query the Action log and app data, for example approvals that bypassed DoA, duplicate vendor bank details or access after termination.

Findings and reporting

Findings record condition, criteria, cause, effect, rating, recommendation, management response, owner and due date. Follow-ups track action plans and closure evidence, validated by auditors. A report builder assembles findings into reports with review and issuance. The audit committee dashboard shows plan progress, ratings, overdue actions and repeat findings.

Independence

Auditors declare conflicts, auditees cannot edit workpapers, and audit runs in a separate permission scope.

Internal Audit is W4-eligible, but delivery is proposed for W5 because the findings-to-GRC loop needs GRC to be mature first. Continuous auditing and a quality assurance programme are planned for W5.