How to Conduct an Internal Financial Audit: A Step-by-Step Guide

To conduct an internal financial audit effectively, start with a risk-based scope: identify where control failures would hurt your organization most, test those controls first, document every piece of evidence, and require formal written responses from management before the report closes. That sequence, endorsed by the Institute of Internal Auditors (IIA) and aligned with PCAOB standards, is what separates a credible audit from a compliance checkbox.

Start here — your 72-hour launch checklist:

• Confirm the audit's scope, objectives, and materiality threshold with the CFO or audit committee
• Conduct a preliminary risk assessment to rank auditable areas by likelihood and impact
• Schedule the entrance meeting with process owners and distribute a document request list
• Assign audit team roles (lead, staff auditor, process owner liaison) and set fieldwork dates
• Open the audit file and prepare documentation before testing begins

Typical audit cadence (operational audit):

Authority signals to keep in view throughout: IIA Global Internal Audit Standards for methodology, PCAOB AS 1000 for evidence and skepticism requirements, and Amcfo's fractional CFO practice for practical implementation support.

Table of Contents

• What is an internal financial audit, and how does it differ from an external audit?
• When should you run an internal financial audit?
• How to run the internal financial audit process step by step
• What does solid fieldwork actually look like?
• How should you structure workpapers and the audit file?
• How do you write the audit report and get real management responses?
• What standards and professional behaviors govern internal audits?
• What do internal financial audits typically find?
• Which tools and analytics help you run a faster, better audit?
• How do you apply a risk-based approach in practice?
• Key Takeaways
• The part most audit guides skip
• Amcfo can handle your internal financial audit from start to finish
• Authoritative references and further reading

What is an internal financial audit, and how does it differ from an external audit?

An internal financial audit is a company-initiated evaluation of accounting processes, internal controls, and compliance practices. Its primary goals are assurance (are controls working?), process improvement (where are the gaps?), and risk mitigation (what could go wrong before it does?). Internal audits are typically structured in five phases: selection, planning, fieldwork, reporting, and follow-up, and they can run quarterly, annually, or on a project-specific basis.

Internal vs. external audit: the key distinctions

Who is involved and what do they own?

• Audit committee: Oversees the internal audit function, approves the audit plan, and receives final reports
• CFO / Controller: Provides financial data, responds to findings, and owns remediation timelines
• Internal audit lead: Designs the audit program, supervises fieldwork, and signs off on the report
• Process owners / operational managers: Supply evidence, explain controls, and commit to corrective actions
• External auditors: May rely on internal audit work to reduce their own testing scope, creating a coordination opportunity

Common financial audit types

Within the financial audit umbrella, several sub-audits deserve separate treatment when risk warrants it:

• Payroll audit: Verifies accuracy of compensation, deductions, and tax withholdings
• Accounts payable/receivable audit: Tests authorization, completeness, and aging accuracy
• Financial close controls audit: Examines journal entry approvals, reconciliations, and period-end cutoff
• Benefit plan audit: Reviews plan eligibility, contributions, and compliance with ERISA requirements

Each can be scoped as a standalone engagement or folded into a broader annual audit, depending on risk level and available resources.

When should you run an internal financial audit?

Timing an audit well is half the battle. The most common mistake is scheduling audits by calendar rather than by risk, which means high-exposure areas go untested while low-risk processes get reviewed on autopilot.

Event-driven triggers that should prompt an immediate audit:

• A regulatory change affecting financial reporting or tax treatment
• A control failure or fraud allegation, even unconfirmed
• A merger, acquisition, or significant system migration
• Leadership request or audit committee directive
• A material restatement or external auditor finding

Recommended recurring frequencies by risk level:

• High-risk areas (payroll, revenue recognition, cash disbursements): quarterly or semi-annual
• Moderate-risk areas (accounts payable, expense reporting, fixed assets): annual
• Lower-risk areas (prepaid expenses, minor accruals): every 18–24 months or as part of a rotating schedule

Sample cadences:

Aligning audit objectives with management's stated key risks is non-negotiable. Before finalizing the audit plan, review the company's risk register (or build one if it does not exist), interview department heads about their top concerns, and cross-reference with any prior audit findings. That alignment keeps the audit relevant and reduces pushback during fieldwork.

How to run the internal financial audit process step by step

UNC's internal audit office structures audits in three primary phases: planning, fieldwork, and reporting. The GAO Financial Audit Manual adds a fourth phase for internal control testing and a fifth for follow-up. The framework below integrates both into a practical playbook.

Step 1: Planning

Planning is where the audit either succeeds or fails before fieldwork begins. PwC's audit guidance makes the point clearly: auditors use risk assessment to design an overall strategy and detailed plan, then reassess continuously as new information surfaces.

Planning checklist:

1. Define the audit universe (all auditable entities, processes, and accounts)
2. Conduct a risk assessment: score each area by likelihood and impact (see Section 11 for the scoring template)
3. Set materiality thresholds for financial statement items
4. Draft the scope statement: what is included, what is explicitly excluded, and why
5. Identify staffing needs and assign roles (lead auditor, staff, subject-matter support)
6. Set the audit timeline with milestones for each phase
7. Hold the entrance meeting with process owners to explain scope, objectives, and document request expectations

Audit program template (adapt for your engagement):

Step 2: Fieldwork

Fieldwork is where you test what planning assumed. Assign each procedure to a specific auditor, set evidence-collection deadlines, and document findings in real time rather than reconstructing them later.

Key fieldwork tasks include interviews with process owners, walkthroughs of key controls, transaction testing, and data analysis. Auditors prioritize testing areas identified during planning as high-risk, focusing on compliance with laws, policies, and accounting standards. Any exception found during testing should be documented immediately with the supporting evidence attached.

Step 3: Reporting

Draft the report with findings organized by severity. Share the draft with management before finalizing so they can provide context and commit to corrective actions. The final audit output is a detailed report with findings and recommendations; management reviews drafts and provides a formal response and corrective action plan that auditors track during follow-up.

Step 4: Follow-up

Follow-up is not optional. Set a tracking cadence (30, 60, 90 days post-report) and require evidence of remediation before closing each finding. Unresolved findings should escalate to the CFO or audit committee.

Roles and suggested time allocations:

Pro Tip: Hold a brief alignment call with the process owner before fieldwork begins. Confirm what documents exist, what systems they live in, and who the day-to-day contact will be. That 30-minute call routinely cuts evidence-collection time by days and reduces the defensiveness that slows reporting.

What does solid fieldwork actually look like?

Fieldwork has two distinct modes, and knowing when to use each one determines how much your findings will hold up under scrutiny.

Control testing vs. substantive testing

Control testing asks: is this control designed properly, and is it actually operating? You test a control by examining evidence that it ran (approval signatures, system logs, segregation of duties in the access matrix). If controls test as effective, you can reduce the volume of substantive work.

Substantive testing asks: is the dollar amount or transaction correct, regardless of whether controls ran? You test substantively by recalculating balances, confirming amounts with third parties, or tracing transactions to source documents. Use substantive testing when controls are absent, untested, or have failed.

Sampling guidance

Statistical sampling uses probability theory to let you generalize from a sample to a population. Judgmental sampling relies on auditor expertise to select items most likely to reveal errors. For high-risk populations (payroll, cash disbursements), statistical sampling is preferable because it is defensible. For smaller populations or targeted testing, judgmental sampling is acceptable if you document the rationale.

Sample size should reflect risk: higher risk means larger samples. Moderate-risk controls often involve testing several dozen items; high-risk controls warrant testing more extensive samples.

Test matrix example

Evidence collection checklist

• Bank confirmations (direct from the financial institution, not management-supplied)
• Account reconciliations with preparer and reviewer signatures
• System-generated transaction logs and access reports
• Vendor invoices, purchase orders, and receiving documents
• Payroll registers and supporting time records
• Board or management approval minutes for significant transactions
• Third-party contracts and agreements for material commitments

PCAOB standards require auditors to obtain sufficient appropriate evidence and exercise professional skepticism throughout. That means corroborating management representations with independent data wherever possible. A bank confirmation obtained directly from the bank carries far more weight than a balance the controller printed from the accounting system.

When you encounter an exception, document it fully before discussing it with management. Note the control objective, the specific deviation, the dollar amount or frequency, and the potential impact. Exceptions that cluster around a single employee, vendor, or account period deserve immediate escalation.

Pro Tip: During walkthroughs, ask the process owner to show you the last time the control actually ran, not just describe how it is supposed to work. The gap between the policy and the practice is where most findings live.

How should you structure workpapers and the audit file?

Good documentation does two things: it supports your conclusions, and it lets a reviewer reconstruct your logic without asking you a single question. PCAOB auditing standards require audit documentation to support significant conclusions and facilitate review. That standard applies equally to internal audits.

Workpaper structure and naming conventions

Every workpaper should carry:

• Index reference (e.g., WP-01, WP-02) tied to the audit program step it supports
• Purpose statement: one sentence explaining what the workpaper proves
• Preparer name and date
• Reviewer name and date
• Conclusion: a clear statement of whether the control or balance tested as expected

Essential workpapers

• Planning memo (scope, objectives, risk assessment summary, materiality)
• Risk assessment workpaper with scoring matrix
• Sampling plan and population description
• Test workpapers for each audit program step
• Copies of key evidence (reconciliations, confirmations, approval logs)
• Issue memos for each finding, including root cause and potential impact
• Management response documentation

Minimal workpaper fields

Retention and security

Internal audit records should be retained for a minimum of seven years, consistent with general U.S. document retention guidance for financial records, though your legal counsel should confirm the period for your specific industry and regulatory environment. Store workpapers in a system with role-based access controls so only authorized team members can view or edit files. Version control matters: never overwrite a workpaper once it has been reviewed. Use a naming convention that includes the version number and date so the audit file tells its own story.

For organizations subject to SOX or handling sensitive financial data, aligning your audit file security with recognized financial data security standards adds a defensible layer of protection and reduces exposure if the file is ever subpoenaed or reviewed by regulators.

How do you write the audit report and get real management responses?

The audit report is the product. Everything else in the process exists to support it. A report that is vague, poorly organized, or missing management responses will not drive remediation, no matter how good the fieldwork was.

Audit report structure

1. Executive summary: Two to three paragraphs covering the audit's purpose, scope, overall conclusion, and the most significant findings
2. Scope and objectives: What was audited, the time period covered, and what was explicitly excluded
3. Key findings: Each finding includes a condition (what was found), criteria (what should be), cause (why it happened), and effect (what the risk is)
4. Root-cause analysis: A brief explanation of the systemic reason the finding exists, not just the symptom
5. Recommendations: Specific, actionable steps management should take
6. Management response: Management's formal written reply, including whether they agree, their planned corrective action, the responsible owner, and the target completion date

Issues register template

Sample finding language

Finding F-001 (High): During testing of accounts payable disbursements, 12 of 40 sampled payments lacked the required dual authorization. The company's policy requires two approvals for payments exceeding $5,000. The absence of a system-enforced approval workflow allows single-approver payments to process without detection. This creates exposure to unauthorized disbursements and potential fraud.

Recommendation: Configure the accounting system to require a second electronic approval before any payment above the threshold is released. Until the system change is complete, implement a manual review of all disbursements by the Controller.

Draft review and distribution

Share the draft report with process owners and the CFO at least five business days before finalizing. This is not a courtesy; it is a quality control step. Management may have context that changes a finding's severity or reveals a compensating control you did not observe. Once responses are incorporated, distribute the final report to the CFO, CEO, and audit committee. Track open findings on a 30/60/90-day cadence and require written evidence of remediation before closing each item.

What standards and professional behaviors govern internal audits?

Three bodies set the professional framework for internal auditing in the U.S., and understanding where each applies keeps your audit defensible.

Core authorities:

• IIA Global Internal Audit Standards: The primary methodology framework for internal audit functions worldwide, covering independence, planning, fieldwork, reporting, and quality assurance
• PCAOB Auditing Standards (AS 1000 series): Govern external auditors but set the evidence and skepticism benchmarks that credible internal audit work mirrors
• COSO Internal Control Framework: The dominant model for designing and evaluating internal control systems; most U.S. companies use COSO's five components (control environment, risk assessment, control activities, information and communication, monitoring) as their control taxonomy

Independence and ethics checklist:

• The internal audit function reports directly to the audit committee, not to the CFO or Controller
• No auditor tests a process they were involved in designing or operating within the past year
• Conflicts of interest are disclosed in writing before the audit begins
• Audit committee reviews and approves the annual audit plan independently of management

Professional skepticism in practice: PCAOB standards describe professional skepticism as a questioning mind and a critical assessment of audit evidence. In practice, that means not accepting a reconciliation at face value because the Controller prepared it. It means tracing the reconciling items to source documents, confirming balances directly with banks, and asking why an adjustment was made rather than assuming it was routine.

SOX considerations for public companies: Under the Sarbanes-Oxley Act, Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting, and external auditors must attest to that assessment. Internal audit plays a central role in testing controls and providing evidence that management's assessment is supportable. If your organization is a public company or planning to go public, align your internal control testing with the COSO framework and coordinate closely with your external auditors to avoid duplicating work.

For organizations managing sensitive financial data, ISO 27001 audit preparation provides a practical framework for securing the evidence and systems your audit relies on.

What do internal financial audits typically find?

Most organizations, regardless of size or sophistication, tend to surface the same categories of deficiencies. Knowing them in advance lets you prioritize controls before an audit finds them the hard way.

Common findings:

• Segregation of duties gaps: One person can initiate, approve, and record a transaction without a second set of eyes. This is the single most common finding in small and mid-size companies.
• Missing or late approvals: Transactions processed without required authorization, often because the approval workflow was bypassed for speed.
• Reconciliations not performed: Account reconciliations skipped during busy periods, leaving undetected errors or fraud in the balance.
• Unsupported journal entries: Manual journal entries with no backup documentation, no explanation, and no reviewer signature.
• Obsolete access rights: Former employees or employees who changed roles still holding system access they no longer need.
• Inadequate documentation of estimates: Accounting estimates (allowances, reserves, depreciation) with no documented methodology or support.

Developing financial controls proactively addresses most of these before an audit surfaces them.

Red flags that warrant immediate escalation:

• Repeated management overrides of established controls, especially by the same individual
• Unexplained adjustments to revenue or expense accounts near period-end
• Rapid growth in payments to a single vendor without corresponding purchase orders
• Employees who never take vacation (a classic fraud indicator, since absence disrupts concealment)
• Significant discrepancies between physical inventory counts and system records
• Unusual wire transfers or payments to unfamiliar accounts

When a red flag appears during fieldwork, stop testing that area, preserve all evidence in its current state, and escalate to the audit lead and CFO immediately. Do not discuss the finding with the process owner until the escalation path is clear. Depending on the severity, the audit committee may need to be notified before the draft report is issued, and forensic accounting procedures may be warranted.

Which tools and analytics help you run a faster, better audit?

Manual audit work is slow and prone to sampling gaps. The right tools reduce both problems without requiring a large technology budget.

Tool categories to consider:

• Audit management platforms: Software that houses the audit plan, workpapers, issues register, and management responses in one place. Look for role-based access, version control, and a built-in audit trail.
• ERP audit trail modules: Most modern ERPs (SAP, Oracle, NetSuite, QuickBooks Enterprise) generate transaction logs and access reports natively. Know how to pull them before fieldwork starts.
• Data analytics tools: ACL Analytics (now Galvanize), IDEA, or SQL queries against your accounting database let you test entire populations rather than samples. Running a completeness check on all journal entries takes minutes; reviewing 60 paper entries takes days.
• Confirmation automation: Platforms that send and receive bank and accounts receivable confirmations electronically reduce turnaround time and eliminate the risk of intercepted paper confirmations.
• Secure file sharing: Use encrypted, access-controlled platforms for exchanging sensitive documents with process owners. General email is not adequate for audit evidence.

Tool selection checklist:

• Does it integrate with your existing accounting system?
• Does it produce documentation output that meets your workpaper standards?
• Does it enforce user access controls and maintain an audit trail of changes?
• Can it be configured to your audit program structure?

Pro Tip: Before sampling, run a data analytics query to identify the full population of exceptions: all journal entries posted after business hours, all payments that end in round numbers, all vendors added within 30 days of a payment. That query often surfaces the highest-risk items before you pull a single sample, letting you focus manual testing where it matters most.

How do you apply a risk-based approach in practice?

A risk-based internal audit approach concentrates effort where failures would most impair objectives. That is both more efficient and more persuasive to senior management than auditing by rote. The IIA's guidance on risk-based internal audit planning makes this the expected standard, not an optional enhancement.

The Technical Guide on Risk-Based Internal Audit outlines the importance of evaluating risk maturity and modifying the audit approach when no formal risk framework exists. For many U.S. mid-market companies, that is the starting point.

Risk assessment scoring template

Score each auditable area on two dimensions:

Multiply likelihood × impact to get a risk score (1–9). Areas scoring 6–9 get priority audit coverage; areas scoring 1–3 rotate on a longer cycle.

Risk-to-scope mapping table

Building a risk register when none exists

When no formal risk management framework exists, modify the audit approach: perform a department-level risk assessment, focus on high-impact controls, and include recommendations to build a risk register as part of the audit deliverables. Interview department heads, review prior audit findings, and examine any regulatory correspondence. That process produces a working risk register even if management has never maintained one formally.

Pro Tip: Never accept management's risk register at face value. Validate it by comparing it to prior audit findings, industry benchmarks, and any regulatory correspondence. Management tends to underweight risks in areas they are proud of and overweight risks in areas where they want more resources. Your job is to calibrate that inventory, not ratify it.

Key Takeaways

A risk-based internal financial audit that tests key controls, documents evidence to PCAOB standards, and requires formal management responses is the most defensible and effective approach for U.S. organizations of any size.

The part most audit guides skip

Most how-to guides on internal auditing treat the process as a technical exercise: follow the steps, fill in the workpapers, issue the report. What they understate is that the audit's value is almost entirely determined by what happens after the report lands.

The finding that says "segregation of duties gap in accounts payable" is not news to most CFOs. They knew. The question is whether the audit creates enough structured accountability that the fix actually happens. That requires two things most internal teams do not build into their process: a genuinely independent reporting line and a follow-up mechanism with teeth.

The reporting line matters more than most managers realize. When internal audit reports to the CFO rather than the audit committee, findings that reflect poorly on the CFO's team tend to get softened, delayed, or quietly deprioritized. The audit committee reporting line is not a formality; it is the structural guarantee that findings reach people with the authority and incentive to act on them.

The follow-up mechanism is where most audits quietly fail. A 90-day action plan with no one checking whether the evidence of remediation actually arrived is not a plan. It is a list. The audits that produce measurable improvement are the ones where the audit lead returns at 30, 60, and 90 days, reviews the evidence, and escalates unresolved items to the audit committee by name.

One more thing worth saying plainly: the risk-based approach is not just a methodology preference. It is the difference between an audit that management respects and one they tolerate. When auditors can explain exactly why they tested payroll before prepaid expenses, and can tie that decision to a specific risk score, the conversation shifts. Management stops seeing the audit as an intrusion and starts seeing it as a tool. That shift is what makes remediation happen.

Amcfo can handle your internal financial audit from start to finish

Running a credible internal financial audit requires planning discipline, testing rigor, and follow-through that most internal teams are stretched to deliver alongside their day-to-day responsibilities. Amcfo's fractional CFO and accounting practice fills that gap without the overhead of a full-time hire.

Relevant services for organizations preparing for or running an audit include fractional CFO oversight of the audit process, bookkeeping cleanup to ensure records are audit-ready, forensic accounting for engagements where red flags have surfaced, and operational efficiency audits that produce findings and remediation plans in the same format external auditors expect. A typical engagement begins with a diagnostic scoping call, moves into a defined fieldwork phase with clear deliverables, and closes with a findings report and a tracked remediation plan.

If your organization needs audit-ready financials, a structured findings report, or ongoing CFO-level oversight of corrective actions, schedule a diagnostic call with Amcfo to scope the right engagement for your situation.

Authoritative references and further reading

The sources below are the primary documents and guidance bodies that underpin the methodology in this guide.

• IIA Global Internal Audit Standards: The foundational methodology framework for internal audit functions. Start here if you are building or restructuring an internal audit program. Most relevant for internal auditors and audit committee members.
• PCAOB AS 1000: General Responsibilities of the Auditor: Sets the evidence and professional skepticism standards that credible internal audit work mirrors. Relevant for any auditor designing fieldwork procedures.
• COSO Internal Control Framework: The dominant U.S. model for designing and evaluating internal controls. Use this to structure your control taxonomy and map findings to control components.
• GAO Financial Audit Manual: Detailed procedural guidance for federal financial audits; the four-phase model (planning, internal control, testing, reporting) translates directly to private-sector practice.
• Investopedia: Internal Audit Overview: A clear, accessible summary of audit types, phases, and the risk-based approach. Good starting point for managers new to the audit process.
• Amcfo Fractional CFO Services: Practical templates, scoped audit engagements, and ongoing CFO-level support for organizations that need external expertise to plan and run internal audits.

This article provides general informational guidance on internal financial audit practices and does not constitute legal, accounting, or professional audit advice. Confirm current standards and requirements with a qualified professional for your specific situation.

Recommended

• The Financial Close Process: A 2026 Guide for Finance Teams
• How to Develop Financial Controls for Your Company
• How to Measure Business Financial Health Accurately
• How to Prepare a Business Financial Review in 2026