Internal Audit Process: Planning, Testing, Reporting and Follow-Up

The internal audit process exists to answer one question honestly: are this organization’s risk management, controls, and governance actually working, or do they just look like they are on paper? That distinction matters more in 2026 than it did even a few years ago. The Institute of Internal Auditors (IIA) introduced its new Global Internal Audit Standards in January 2024, which became mandatory for conformance from January 9, 2025 — meaning a lot of internal audit guidance still circulating online is already outdated. Separately, the UAE’s Securities and Commodities Authority (SCA) tightened governance rules for listed companies in January 2024, explicitly requiring the internal audit function to be kept separate from the compliance function for the first time.

This guide walks through the internal audit process the way it’s actually practiced today — planning, testing, reporting, and follow-up — with the regulatory context most articles on this topic leave out entirely.

Key Roles and Responsibilities in the Internal Audit Process

Before walking through the four phases, it’s worth being clear on who actually does what — a detail generic explanations of the internal audit process often skip, leaving readers unclear on accountability.

• The Audit Committee — a board-level committee that approves the audit plan, reviews findings, and holds management accountable for remediation. Under current UAE governance rules for listed companies, the audit committee also reviews the internal audit function’s own effectiveness.
• The Chief Audit Executive (CAE) — leads the internal audit function, reports functionally to the audit committee (to preserve independence) and administratively to senior management, and is ultimately accountable for the quality of the audit process.
• Internal Auditors — the staff who perform planning, fieldwork, testing, and reporting for individual engagements, ideally with a mix of generalist and specialist skills (IT audit, fraud, treasury) depending on the organization’s risk profile.
• Process Owners / Management — the business units being audited, responsible for providing access to information, responding to findings honestly, and implementing agreed corrective actions on time.
• External Quality Assessors — periodically (typically every five years under IIA guidance) an internal audit function should undergo an external quality assessment to confirm it genuinely conforms with current standards, rather than simply asserting that it does.

Clear separation between these roles — particularly keeping internal audit independent from the functions it reviews — is precisely what the SCA’s 2024 governance amendments reinforced by prohibiting the compliance officer and internal audit roles from being combined.

What Is Internal Audit, Really?

Internal audit is an independent, objective function within an organization that evaluates and improves the effectiveness of risk management, internal controls, and governance processes. It’s easy to confuse with external audit, but the two serve fundamentally different purposes — and understanding the difference is the first gap most generic explanations skip.

Aspect	Internal Audit	External Audit	Statutory Audit
Purpose	Improve operations, risk management, and controls	Express an opinion on financial statement accuracy	Fulfil a legal requirement for financial reporting
Who it reports to	Audit committee / board	Shareholders	Regulators and shareholders
Scope	Operational, financial, compliance, IT, strategic risk	Primarily financial statements	Financial statements only
Frequency	Continuous / risk-based throughout the year	Typically annual	Typically annual
Independence	Independent of management, but part of the organization	Fully independent, external firm	Fully independent, external firm

The internal audit process isn’t a once-a-year event like a statutory audit. It’s a continuous, risk-based cycle — which is exactly why the four phases below need to work as a connected system, not four isolated checkboxes.

Why the Internal Audit Process Matters More in the UAE Right Now

Two regulatory shifts make this a genuinely current topic rather than an evergreen one dressed up as fresh content:

• The 2024 Global Internal Audit Standards (GIAS) replaced the 2017 International Standards for the Professional Practice of Internal Auditing. The new framework consolidates guidance into five domains, 15 principles, and 52 standards, and became the required benchmark for conformance from January 9, 2025. Any internal audit function still operating purely on 2017-era guidance is technically behind current practice.
• SCA’s January 2024 amendments to the UAE Joint Stock Companies Governance Guide now explicitly prohibit combining the compliance officer role and the internal audit function into a single position for listed public joint stock companies, and place greater emphasis on demonstrable, evidenced control effectiveness rather than policy documents alone.

Even businesses not directly bound by SCA rules — private companies, free zone entities, growing SMEs — are increasingly expected by banks, investors, and boards to demonstrate a comparable standard of internal control assurance. This is where a properly run internal audit process becomes a genuine business asset, not just a compliance formality.

Phase 1: Planning the Internal Audit

Planning is where most of the actual value of an internal audit is decided — get this phase wrong, and no amount of careful testing later will compensate.

Risk Assessment and Audit Universe

The internal audit process begins by identifying the full “audit universe” — every auditable entity, process, or system within the organization — and then assessing each against risk factors such as financial materiality, past control failures, regulatory exposure, and strategic significance. This risk assessment determines which areas get audited, and how often, rather than auditing everything equally regardless of risk.

Building the Annual Audit Plan

The risk assessment feeds into an annual (or rolling) audit plan, which the audit committee or board typically approves. A well-built plan includes:

• Prioritized audit topics, ranked by risk score rather than convenience or history, so the areas most likely to cause real damage get attention first rather than the areas that are simply easiest to schedule.
• Resource allocation — deciding which audits need specialist skills (IT, fraud, treasury) versus general audit staff, and whether co-sourcing with an external advisory firm is needed to cover skill gaps.
• A realistic timeline that accounts for business cycles and avoids auditing finance teams during month-end close, sales teams during peak season, or any team during a major system migration, since rushed access during a busy period tends to produce shallow, adversarial engagements rather than useful ones.

Scoping the Individual Audit Engagement

Before fieldwork starts, each individual audit needs a defined scope: objectives, boundaries, the period under review, and the specific risks and controls being tested. A vague scope is one of the most common reasons internal audits run over time and still miss the issues that actually mattered — auditors end up testing everything shallowly instead of the highest-risk areas thoroughly.

Common Planning Mistakes

• Building the audit plan around what was audited last year rather than a fresh risk assessment
• Failing to involve the audit committee early enough to align on priorities
• Scoping engagements too broadly, diluting focus away from genuine risk areas

Phase 2: Testing (Fieldwork)

This is where the internal audit process moves from paper to evidence.

Understanding the Process and Controls

Auditors first walk through the actual process — not just the documented policy — to understand how it really operates. This often surfaces a first, informal finding: policy and practice frequently diverge, and that gap itself is worth noting before formal testing even begins.

Designing and Performing Test Procedures

Testing methods vary depending on the risk and control type, and typically include:

• Inquiry — interviewing process owners and staff
• Observation — watching a control being performed in real time
• Inspection — reviewing documents, approvals, and system records
• Re-performance — independently redoing a calculation or control step to confirm the result
• Data analytics — testing full populations of transactions rather than small samples, increasingly the standard approach for high-volume processes

Sampling vs. Full-Population Testing

A gap in a lot of internal audit content is treating sampling as the default without qualification. Modern internal audit functions, supported by data analytics tools, increasingly test entire transaction populations for high-risk areas rather than relying on small samples — which both increases confidence in findings and reduces the risk of missing an outlier issue that a sample would have excluded entirely.

Documenting Findings as You Go

Every test result — pass, fail, or exception — needs to be documented with sufficient evidence to support the conclusion, since this evidence becomes the backbone of the audit report and needs to withstand later scrutiny from the audit committee or, in some cases, an external quality assessment of the internal audit function itself.

Phase 3: Reporting

A technically accurate audit that produces a report nobody reads or acts on has failed at its actual purpose.

Structuring Findings by Risk, Not Discovery Order

Findings should be presented in order of risk severity and business impact, not the order they happened to be discovered during fieldwork. A report that buries a critical control failure on page 12 behind five minor observations is a structural failure, regardless of how accurate the underlying testing was.

What a Strong Internal Audit Report Includes

• Executive summary — a plain-language overview for the audit committee and board, written for readers who won’t read the full detail
• Objective and scope — what was and wasn’t covered
• Findings, each with root cause, business impact, and risk rating
• Management’s response and action plan for each finding, ideally negotiated before the report is finalized, not appended afterward
• Overall opinion or rating, where the internal audit methodology includes one

Communicating Findings Effectively

Reports should focus on business impact and root cause, not just rule violations. “Invoices were not approved per policy” is a weaker finding than “unapproved invoices created a AED X exposure to duplicate or fraudulent payment, driven by a bypassed approval workflow in the finance system.” The second version gives management something concrete to actually fix.

Phase 4: Follow-Up

This is the phase most competing content treats as an afterthought — often covered in a single sentence — despite it being where audit value is either realized or lost entirely.

Tracking Management Action Plans

Every finding’s agreed action plan needs an owner, a deadline, and a tracking mechanism. Without structured tracking, action plans quietly stall, and the same finding often reappears in next year’s audit — a pattern that damages the credibility of the entire internal audit function over time.

Validating Remediation, Not Just Trusting It

A mature internal audit process doesn’t just ask management whether an issue was fixed — it independently verifies the fix through re-testing, particularly for high-risk findings. This is one of the clearest signs of a strong internal audit function versus a purely paper-based one.

Reporting Follow-Up Status to the Audit Committee

Overdue or unresolved high-risk findings should be escalated to the audit committee, not left to quietly age in a tracking spreadsheet. Under the SCA’s current governance rules, the audit committee is specifically expected to review outstanding internal audit issues and the effectiveness of corrective actions as part of its own annual reporting.

Measuring Follow-Up Effectiveness

Useful metrics include the percentage of findings closed by their original deadline, average time to remediation by risk rating, and repeat-finding rates. Very few internal audit articles online mention tracking these KPIs at all, despite them being one of the clearest indicators of whether an internal audit function is actually driving improvement or just producing reports.

How Technology Is Changing the Internal Audit Process

Modern internal audit functions increasingly rely on governance, risk, and compliance (GRC) platforms and audit management software to run the planning-to-follow-up cycle, rather than managing it through spreadsheets and email. These tools support continuous risk scoring, automated workpaper documentation, real-time dashboards for the audit committee, and, increasingly, data analytics that test full transaction populations instead of samples. For growing UAE businesses without a dedicated GRC platform, even a well-structured shared tracker with clear ownership and deadlines meaningfully improves follow-up discipline compared to informal email chains.

Common Mistakes That Undermine the Internal Audit Process

• Treating internal audit as a compliance checkbox rather than a genuine improvement function, which leads to shallow scoping and findings nobody acts on
• Combining internal audit with other functions (like compliance) in smaller organizations, creating independence conflicts that current UAE governance rules now explicitly discourage for listed entities
• Under-resourcing the follow-up phase, so findings are documented well but never actually tracked to closure
• Writing reports for auditors, not for decision-makers — overly technical language that obscures business impact from the board members who need to act on it
• Auditing the same low-risk areas repeatedly out of habit, while higher-risk emerging areas — like third-party vendor risk or newly implemented systems — go unreviewed for years simply because they weren’t part of the traditional audit rotation

Building an Effective Internal Audit Function as You Grow

Smaller and mid-sized UAE businesses often can’t justify a full in-house internal audit department early on, but that doesn’t mean the internal audit process should be skipped entirely. Common approaches at different growth stages include:

• Outsourced internal audit — engaging an external advisory firm to run periodic risk-based audits without a permanent internal team
• Co-sourced internal audit — a small internal function supplemented by external specialists for complex areas like IT or fraud
• In-house internal audit function — typically justified once the organization reaches sufficient scale, complexity, or regulatory obligation (such as SCA-listed status)

Whichever model fits your stage, the same four-phase discipline — planning, testing, reporting, and follow-up — should apply consistently; scaling down the function shouldn’t mean scaling down the rigor. The mistake to avoid is treating a smaller internal audit setup as a reason to skip planning or follow-up altogether — those are exactly the phases where discipline matters most when resources are limited, since a poorly scoped or never-followed-up audit wastes the little audit capacity a growing business has.

Conclusion: Turning Internal Audit Into a Genuine Business Advantage

A well-run internal audit process does more than satisfy a governance requirement — it gives management and the board an honest, evidence-based view of where the organization’s real risks and control gaps actually sit, before they turn into financial losses, regulatory penalties, or reputational damage. The businesses that get the most value from internal audit are the ones that treat planning, testing, reporting, and follow-up as one connected discipline, aligned with current standards like the 2024 Global Internal Audit Standards, rather than a once-a-year formality.

My Taxman supports UAE businesses with the advisory and compliance groundwork that strong governance depends on — from accounting and internal controls to CFO-level advisory and due diligence support. If your business needs help building or strengthening its internal audit and governance framework, connect with My Taxman to discuss an approach suited to your current stage of growth.

FAQS FOR INTERNAL AUDIT PROCESS