Internal Audit Hints and Tips

Interesting, thanks.

It might not hurt to take a step back. I think everyone now expects a "process based" audit, but how does an auditor determine the processes to consider. Purchasing, for example, is a "process" but I think the intent of the process based approach is to consider from identification of need to purchase (which is potentially spread across multiple groups) through, I suppose, acceptance of the purchased materials and all the sub-processes that go with it (e.g., re the purchasing records properly controls (Document and Record Control), do the players involved from beginning to end have sufficient competence [which leads possibly to training and additional records], etc.).

Frequently, I see an auditor ask for a couple of POs and confirms that the materials are received. Check, Purchasing Process done. That's not going to be an effective audit.

The Purchasing process (conceptually) is a good example. Purchasing, say, a software application to support design and development (e.g., Jira for issue tracking) is quite different from purchasing raw material (that requires unquestionable traceability) and purchasing an outsourced service introduces more differences. If I don't look at both, I might not see gaps in one.

Frankly, I often struggle with determining what the (right) processes are to ensure the broadest coverage, but I think, conceptually, I take the right approach. Most instructional guides start, where you did, with the assumption that the auditor knows what the processes are. Maybe I'm overthinking but some tips along those lines might be helpful.