How Audit Procedures and Internal Controls Improve Your Compliance Posture

As businesses enhance their risk management techniques, the importance of efficient audit procedures and robust internal controls cannot be overstated. Audit procedures are used by audit teams to identify and assess risks. Auditors can also recommend mitigation, such as a control effectiveness deficiency that could impact an organization’s operations and financial health. Strong compliance audit procedures help you document how controls are designed, how they operate in practice, and how exceptions are handled before they become external findings.

A consistent audit monitoring process then keeps those controls on track between audits by surfacing drift, missed reviews, and overdue remediation early.

But how do audit procedures and internal controls impact the overall assessment of controls for external audits? By auditing the effectiveness of internal controls, auditors can identify gaps in processes and controls that could later impact external audits and result in potential findings. Let’s explore.

But how do audit procedures and internal controls impact the overall assessment of controls for external audits? By auditing the effectiveness of internal controls, auditors can identify gaps in processes and controls that could later impact external audits and result in potential findings. Let’s explore.

How audit procedures and internal controls go hand-in-hand

Audit procedures and internal controls have a symbiotic relationship. Supporting each other, they are two pieces of the puzzle that is successful risk management programs. By auditing control effectiveness internally first, auditors can better prepare for external audit procedures and acknowledge where improvements need to be made before auditing against certain frameworks.

But first, we need to understand what audit procedures and internal controls are and how they relate to each other.

What are internal controls?

Internal control is a process designed to ensure that an organization’s operations are effective and efficient, its financial reporting is reliable, and it complies with applicable laws, regulations, and internal policies. They serve as a means to protect the organization and adhere to certain standards and frameworks so that companies can pass audits and achieve compliance certification. Examples of these audited frameworks include SOC 2® and ISO 27001.

Components of internal controls

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework defines the components of internal controls as the following:

The control environment

The control environment is the foundation for all other components of internal control. It provides the discipline and structure necessary for the effective implementation of internal controls within an organization.

Risk assessment

Risk assessment is the process of identifying and analyzing risks that could potentially prevent the organization from achieving its objectives. It involves understanding the internal and external factors that could impact the organization, evaluating the likelihood and impact of these risks, and determining how they should be managed.

Control activities

Control activities are actions taken to mitigate risks and ensure the organization’s objectives are achieved. These activities occur at all levels and functions of the organization and are designed to prevent or detect errors and fraud and ensure compliance with policies and regulations.

Information and communication

Information and communication are critical components of internal controls that ensure the organization’s relevant information is identified, captured, and communicated in a timely manner to enable people to carry out their responsibilities.

Monitoring

Monitoring is the process of assessing the quality of the internal control system over time. This involves regular evaluations to ensure that internal controls function effectively and deficiencies are promptly identified and addressed.

Examples of internal controls

Here are some common internal controls examples that auditors frequently review and test:

• Segregation of duties: Splitting critical tasks (like initiating, approving, and recording transactions) between different people so one person can’t control an entire process end-to-end.
• Approvals and authorizations: Requiring documented approval (e.g., manager sign-off or digital workflow approval) for purchases, journal entries, user access, and key changes.
• Reconciliations: Regularly comparing general ledger balances to supporting records (bank statements, subledgers, inventory counts) and investigating differences.
• Access controls: Limiting system and data access based on job role, using strong authentication, and regularly reviewing user access rights.
• Change management controls: Documenting, testing, and approving system and process changes before they go live.
• Monitoring and logging: Keeping detailed logs of key system activities and reviewing them for unusual or high-risk events.
• Training and policies: Written policies, procedures, and staff training that guide how processes should work and how risks should be managed.

All of these controls should be supported by internal control documentation (policies, procedures, flowcharts, and records) so auditors can see how the process is designed and how it actually operates in practice.

In everyday use, “internal controls” refer to processes and safeguards inside the organization’s own systems and workflows, while “external controls” usually refer to requirements imposed by outside parties (like regulators, customers, or standards bodies) that your internal controls are designed to meet.

What is control testing?

Control testing is an essential part of risk management, especially in the context of risk management audits. Testing controls helps you understand if your company’s controls are properly designed, implemented, and operating effectively to mitigate identified risks. 

Control testing always starts with an internal control risk assessment: understanding which processes and controls matter most to your objectives, and where failures would cause the greatest impact. The higher the inherent risk and control risk in an area, the more extensive your audit tests and further audit procedures need to be.

These tests are crucial to the audit process and provide assurance that the controls in place are adequate to manage the organization’s risks.

What are audit procedures?

An audit procedure is a specific method or step an auditor uses to obtain evidence about how a process or internal control is designed and operating. Audit procedures are the building blocks of audit tests and are selected based on the risks, objectives, and areas being evaluated.

These procedures are the basis of audit tests. An auditor will often pick one or two audit methods (for example, inspection and reperformance) and use those to design their test of control audit steps and any further audit procedures needed when higher risk is identified.

These six steps encompass what you need to know to follow audit procedures. Please note that internal auditing is an ongoing, iterative process that often requires you to follow a repeating cycle of steps, much like the risk management process itself. An external audit is more of a point-in-time event.

1. Inspection

Inspection involves examining documents, records, and physical assets to gather evidence about the effectiveness of controls within the organization.

Examples include document and record inspection, as well as physical asset inspection. Through these inspection activities, auditors gather critical evidence to assess whether the organization’s controls are effectively designed and operating as intended.

2. Observation

Observation involves watching processes and activities as they occur to gather evidence about the effectiveness of a company’s internal controls.

Examples include the observation of physical security measures or processes and procedures. With observation procedures, auditors gain firsthand insight into the practical implementation and effectiveness of the organization’s controls.

3. Confirmation

Confirmation involves obtaining direct verification from third parties or internal stakeholders about specific information or conditions to gather evidence about the controls and their effectiveness.

Examples include confirmation from external parties and from internal stakeholders. Auditors obtain third-party and internal verifications via confirmation activities that provide critical evidence about the effectiveness and reliability of the organization’s risk management practices.

4. Reperformance

Reperformance involves independently executing the procedures and controls initially performed by the organization’s personnel to validate their effectiveness and accuracy.

Examples include reperforming control activities, risk assessments, and compliance procedures. Reperformance allows auditors to validate the effectiveness and accuracy of the organization’s risk management controls and procedures, ensuring they function as intended and provide reliable protection against identified risks.

5. Analytical procedures

Analytical procedures involve evaluating financial and non-financial information through analysis and comparison to identify unusual trends, variances, or relationships that may indicate risks or areas needing further investigation.

Examples include trend analysis, ratio analysis, comparative analysis, and reasonableness tests. Auditors can identify unusual patterns, trends, and variances that may indicate areas of risk or concern, allowing for targeted follow-up and deeper investigation into the organization’s risk management practices.

6. Inquiry

Inquiry involves asking questions of knowledgeable individuals within and outside the organization to better understand the risk management processes, controls, and environment. 

Examples include internal inquiries, external inquiries, inquiries into specific risk areas, and follow-up inquiries. By inquiring about various risk-related activities, auditors gain valuable insights and context surrounding the organization’s risk management practices. This allows for a more informed, comprehensive assessment of the effectiveness and reliability of internal controls and processes.

Example of a risk management audit procedure

An example of a risk management audit procedure is the assessment of the effectiveness of internal controls. By conducting these five steps, auditors can provide assurance on the adequacy and effectiveness of the organization’s risk management practices:

1. Identify key risks

Determine the major risks that could impact the organization’s objectives, such as financial, operational, compliance, or reputational risks.

Note: Some companies may take a different approach and identify their key controls instead. If their program is designed well, the key controls mitigate a larger proportion of the key risks.

2. Evaluate control design

Review the design of the internal controls in place to mitigate identified risks. This includes examining policies, procedures, and documentation.

3. Test control implementation

Perform tests to verify whether the controls are implemented effectively and consistently. This might involve walkthroughs, observations, and sample testing of documents or processes.

4. Access control effectiveness

Analyze the test results to determine whether the controls are functioning as intended and effectively reducing risks to an acceptable level.

5. Report findings and recommendation

Document any deficiencies or weaknesses in the controls and provide recommendations for improving them to strengthen the risk management framework.

The 5 stages of the audit process

When conducting an audit, most teams follow the same five broad stages:

1. Planning and scoping
   Define the objectives, systems, and locations in scope, understand the business, and identify key stakeholders. This is where you decide which internal processes and internal controls will be reviewed.
2. Risk assessment and understanding internal controls
   Perform an internal control risk assessment: identify key risks, understand existing controls, and determine where audit control risk (the risk that the auditor misses a material problem) is highest. This stage drives which areas need more detailed audit tests.
3. Audit testing (tests of controls and substantive tests)
   Design and perform audit procedures. This often includes tests of control audit steps (to see whether controls work as intended) and, where needed, substantive testing of transactions and balances. Further audit procedures include additional tests when initial results show higher risk or control weaknesses.
4. Evaluation and reporting
   Evaluate the results of testing, conclude on control effectiveness, and summarize findings, root causes, and recommendations in an audit report. This is where internal process audit results are translated into practical remediation actions.
5. Follow-up and remediation
   Management implements remediation plans to fix control gaps, and auditors may perform follow-up work to confirm that issues have been addressed. Strong follow-up is essential to reduce ongoing audit control risk and continuously strengthen the control environment.

When should you use these audit testing procedures?

Each audit testing procedure has specific applications depending on the nature of the audit, the objectives, and the areas evaluated. For example, inspection should be used when you need to verify the existence, accuracy, and completeness of documents, records, and physical assets, while analytical procedures should be used when you need to identify unusual trends, variances, or relationships in financial and non-financial data.

By appropriately using these audit testing procedures, auditors can ensure a comprehensive and effective assessment of an organization’s risk management practices and controls.

How audit procedures and internal controls work together

Example

Take a large multinational financial institution. An audit will help ensure that their cybersecurity controls are effective in protecting sensitive data and preventing unauthorized access and cyberattacks.

Audit procedures made easy with Hyperproof

Audit procedures outline the how, what, and why of auditing. Paired with internal controls, audits can help you assess your organization’s compliance and security posture. By acing audits, you prove to the world — and your customers — that you’re ready for what may come your way.

Creating the optimal audit experience benefits many stakeholders. By consolidating all of your work into a unified risk management and compliance platform, you can simplify the audit process and save hours of time on audit preparation.

In fact, one of our customers reduced their audit prep time by 50%, resulting in a more efficient audit experience. With automated evidence collection, dashboards showing audit progress, and personalized invites to their external auditors, they crafted a streamlined audit experience with Hyperproof.

Hyperproof can help accelerate your audit process by connecting audit requests automatically to your controls and associated evidence. Use Hyperproof’s dedicated audit space to invite your auditor to work alongside your team — making information sharing easy and keeping access to only what they need. Plus, assign specific evidence requests from your auditor directly to your team members, so they can communicate directly, reduce friction, and speed the audit process up.

Frequently Asked Questions About Internal Controls and Audit Procedures

What are examples of internal controls?

Examples of internal controls include segregation of duties, approval workflows, reconciliations, system access controls, change management procedures, monitoring and logging, and documented policies and training. Together, these controls form a process designed to ensure effective operations, reliable reporting, and regulatory compliance.

What are the 5 stages of the audit process?

The five stages of the audit process are: planning and scoping, risk assessment and understanding internal controls, audit testing (including tests of controls and substantive tests), evaluation and reporting, and follow-up and remediation. This stage is the backbone of any auditing risk management process because the audit risk assessment process determines what gets tested, how deep you go, and where you apply further audit procedures.

Most audit methods fit into one of these stages.

What is an audit procedure?

An audit procedure is a specific step, test, or method (such as inspection, observation, reperformance, analytical procedures, confirmation, or inquiry) that an auditor uses to gather evidence. Multiple audit procedures are combined into audit tests that support the overall audit conclusion.

What is an internal control risk assessment?

An internal control risk assessment is the process of identifying key risks in a process, mapping them to existing controls, and evaluating where control failures are most likely or would have the biggest impact. The results drive where auditors focus testing and what further audit procedures are needed.

What is a test of control audit?

A test of control audit focuses on whether specific internal controls are designed and operating effectively. For example, an auditor might test whether all high-value purchases had documented approval, or whether user access reviews were performed on schedule.

What is an internal process audit?

An internal process audit is an internally led review of a specific business process (such as onboarding customers or managing changes to systems) to confirm that internal controls are working, risks are being managed, and documentation matches how the process really operates.

Ready to learn more?