The Three Phases of an Audit

An audit creates a stronger decision when the risk that shaped the plan remains visible in the work performed and the conclusion reported.

Inside Assurance uses three phases as a practical map: risk assessment, risk response and reporting. They are connected activities, not sealed boxes. Communication and documentation run throughout, and significant new evidence may require changes to scope or procedures.

Risk assessment: choose the question that matters

Start with the objective of the activity under review. Identify what could prevent that objective, the controls intended to address it and the basis for judging performance.

Turn that understanding into a focused engagement question. For a hypothetical employee-exit process, the question might be: are access rights removed within the organization's agreed timeframe? This is more useful than beginning with a generic request to “check IT controls.”

Risk response: design the work around the question

Here, risk response means the auditor's response through procedures. It does not mean the auditor takes ownership of management's controls or corrective actions.

In the same hypothetical example, connect authorized exit records to user-account data, access-removal evidence and the defined timeframe. Establish what the records cover, test selected items using an explained approach and investigate differences. An incomplete account population limits what the work can support; additional screenshots do not automatically fix that gap.

Reporting: explain what the evidence supports

Carry the original question into the conclusion. Explain the observed issue, its significance, the evidence and any limitation. Distinguish an identified exception from an unsupported assumption about the wider population.

For the hypothetical exit process, a late account removal does not by itself prove unauthorized use. The report should describe the delay and supported exposure without inventing a security incident. If evidence of use is relevant, that requires appropriate additional work.

Connect the handoffs

A simple review question helps across all three phases: can another reviewer follow this conclusion back to the work performed and the risk it was designed to address?

Where the answer is unclear, reconnect the chain before adding more detail to the report. A polished slide cannot repair an unanswered engagement question.

Follow-through still matters

Reporting is not the same as resolving the issue. Management owns the agreed action. Internal audit follows up within its methodology and mandate; a status marked “complete” is not automatically evidence of effective implementation.

This map is an original editorial explanation for internal audit engagements, not a prescribed three-stage framework or a substitute for applicable professional requirements. The IIA's 2024 Global Internal Audit Standards provide the professional reference for planning, engagement work, communicating results and following up actions.

The takeaway: keep one evidence trail from the business objective to the risk, procedure, conclusion and follow-through.

Beyond the numbers. Inside the business.