Internal Audit Engagement Template (IIA Global Internal Audit Standards)

Internal Audit Engagement: [Engagement title]

Record of one internal audit assurance engagement, from the engagement risk assessment and plan through the work program, evidence, findings and final report, to follow-up of management action plans. The structure is aligned with the Institute of Internal Auditors (IIA) Global Internal Audit Standards (GIAS), published 2024-01-09 and effective from 2025-01-09, referenced by domain, principle and standard number only. Internal control criteria use the GAO Green Book 2025 (GAO-25-107721, US public domain). This is the engagement-level companion to the Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan). For an ISO 19011 management-system audit (ISO 9001, ISO/IEC 27001 clause 9.2), use the Internal Audit Program (compliance/internal-audit-program) instead. The example organisation, Corvid Commerce Group plc, is fictional. Replace every [bracketed] value and every row marked Example. Obtain the standards for the normative text. This is a document format, not legal, audit or accounting advice.

Document control

Approvals

Revision history

Contents

• 1. Engagement background and planning inputs
• 2. Engagement risk assessment
• 3. Objectives, scope and evaluation criteria
• 4. Resources, independence and timetable
• 5. Work program
• 6. Results and evidence
• 7. Findings
• 8. Rating scheme
• 9. Overall engagement conclusion
• 10. Final engagement report
• 11. Distribution, follow-up and risk acceptance
• 12. Supervision and quality review
• 13. Traceability matrix
• Glossary and references
• Standard and licence note

1. Engagement background and planning inputs

Describe the area under review in plain terms: what it does, who owns it, which systems support it and why it matters to the organisation's objectives. Record the reason the engagement is in the annual plan (risk score, regulatory requirement, management request or rotation) and what changed since the previous engagement.

Example background: Corvid Commerce Group plc (fictional SaaS retailer, listed in London with American Depositary Shares in New York, IFRS reporter, functional currency EUR) migrated its German and UK entities to a single cloud ERP in March 2026. Group Shared Services processes about 6,000 supplier invoices a month for the German, UK, US and Vietnamese subsidiaries. The supplier master file holds about 4,800 active suppliers. Management reported that bank-detail changes for suppliers are now requested by email and keyed manually by two shared-services clerks, a step that the previous system controlled through a supplier portal.

2. Engagement risk assessment

Identify the significant risks to the area's objectives, including fraud risk and IT risk, and the key controls that management relies on to address them. Rate inherent risk before controls and an expectation of control strength, then set the audit emphasis. Use the organisation's own risk scale (see Risk Methodology, compliance/risk-methodology) so that ratings can be compared with the risk register.

Inherent score is likelihood multiplied by impact on the 1 to 25 scale of the example methodology. Risks scoring 12 or more, any risk with impact 5, and any fraud scheme rated high in the fraud risk assessment receive design and operating effectiveness testing (ER-01, ER-03, ER-05). Risks scoring 8 to 11 receive targeted testing, full-population analytics or reliance on other assurance providers whose work has been evaluated (ER-02, ER-04, ER-06). Risks below 8 receive a walkthrough only. These cut-offs are an example; use your own methodology.

Check whether any IIA Topical Requirement applies. When the engagement covers cybersecurity, or relies on third parties such as an outsourced payment provider or a cloud ERP vendor, the relevant Topical Requirement sets minimum areas to consider; record the assessment and, if a requirement is judged not applicable, the reason. In the example, the cloud ERP is a third-party service, so the IT audit specialist reviews the vendor's assurance report and the complementary user entity controls that Corvid must operate.

Consider fraud risk explicitly. Ask how someone inside or outside the organisation could exploit the process, which red flags would appear in the data, and whether management override of controls is possible. The answers drive the analytics in the work program.

3. Objectives, scope and evaluation criteria

3.1 Engagement objectives

Write each objective so that the report can answer it with a conclusion. Tie each objective to one or more engagement risks.

3.2 Scope

3.3 Evaluation criteria

Record the criteria against which conditions will be judged and confirm them with management at the opening meeting. Criteria can be internal policies, laws, contracts, the organisation's risk appetite, or a recognised control framework. Where a framework is used, cite its principle numbers. The GAO Green Book 2025 is used here because it is in the public domain; organisations that use another framework under licence cite it by name only.

4. Resources, independence and timetable

The example total is 24 + 160 + 60 + 40 = 284 hours. Compare the budget with actual hours in section 12.

Where an auditor has a potential impairment, record the safeguard (a different reviewer, restricted scope or disclosure in the report) and the CAE's decision. Coordinate with other assurance providers to avoid duplicate testing and record whether their work is relied on.

5. Work program

Write each step so that another auditor could re-perform it. State the test type (walkthrough, design, operating effectiveness, analytics, inquiry), the population, the sample method and size, and the workpaper reference. Changes to the approved program need supervisor approval and a note in the revision history.

Sample sizes in the example follow the internal audit manual's table for controls that operate many times a day or weekly; they are not a requirement of any standard. Where data analytics cover the whole population, report the exceptions found rather than extrapolating from a sample.

6. Results and evidence

Summarise each step's result, the number of exceptions and whether the result leads to a potential finding. Keep the detailed evidence in the referenced workpapers and record the evidence source (system extract, inspected document, observation, inquiry). Inquiry alone rarely supports a conclusion on operating effectiveness.

Check the example arithmetic: 9 of 40 is 22.5%; 14 confirmed duplicates leave 3 unrecovered after the 11 credit notes; 2,140 - 2,121 = 19 and 19 / 2,140 = 0.9%. Record the unrecovered amount in the finding once the shared-services team confirms it.

Evidence quality matters more than volume. Prefer evidence obtained directly by the auditor (system extracts with documented parameters, re-performance, observation) over evidence prepared by the auditee. When you rely on a report produced by the system, test its completeness and accuracy first: the example change report failed this test, which is itself part of finding F-01. Record the extraction parameters, the date and the person who ran each query so that results can be reproduced, and store analytics scripts with the workpapers.

7. Findings

Write each finding with the five attributes below, then rate it using section 8. Validate the facts with the process owner before the closing meeting so that the report discusses actions, not facts. Positive observations (controls that worked well) may be recorded in the report summary.

Ask "why" until you reach a cause that management can change: a missing system configuration, an unclear policy, an untrained team, a resourcing gap or a project that did not hand over a control. Group exceptions that share a root cause into one finding instead of reporting each symptom. Quantify the effect where possible (amount, number of items, period exposed) and state when no loss was found, so the reader can judge the rating. If the work suggests possible fraud, stop testing the affected items, inform the CAE and follow the fraud response plan; do not interview suspects within the audit.

F-01 (Example): Supplier bank-detail changes are not consistently verified

F-02 (Example): Duplicate supplier invoices paid after the ERP migration

F-03 (Example): Segregation-of-duties conflicts in ERP roles not detected

7.4 Management action plans

8. Rating scheme

In the example, the final report is dated 2026-10-30, so the two high findings must be addressed by 2027-01-30 (AP-01 due 2026-12-15 and AP-03 due 2026-11-30) and the medium finding by 2027-04-30 (AP-02 due 2027-01-31): all three due dates meet the timeframes below.

Use the same scheme for every engagement in the plan year and publish it in the internal audit manual. GIAS expects findings to be prioritised by significance; the labels and definitions below are an example, not text from any standard.

9. Overall engagement conclusion

State a conclusion for each objective, then the overall rating and the reasoning. Mention significant positive results where they help the reader judge the balance.

Example overall rating: Major improvement needed. Two high findings (F-01 and F-03) together allow a single person, or an external fraudster with a convincing email, to redirect supplier payments without timely detection. Management has agreed actions with due dates that close both exposures by 2026-12-15.

10. Final engagement report

Use the structure below for the report issued to management, with a one-page summary for the audit committee. Keep wording factual and avoid naming individuals in findings.

10.1 Executive summary

Write one paragraph on why the engagement was performed, one on the overall rating and the main messages, and one on what management has agreed to do. Add the finding count by rating.

10.2 Background, objectives and scope

Summarise sections 1 and 3, including entities, systems, the period reviewed and anything excluded. State any scope limitation (for example records that were not provided) and its effect on the conclusion.

10.3 Detailed findings and action plans

Insert the findings from section 7 in order of rating, each followed by the agreed management action plan with owner and due date.

10.4 Conformance statement

State whether the engagement was conducted in conformance with the Global Internal Audit Standards. Make the statement only if the internal audit function's quality assurance and improvement program supports it; otherwise disclose the nonconformance and its effect, as the charter requires.

Example statement: This engagement was conducted in conformance with the IIA Global Internal Audit Standards, as supported by the results of the internal audit function's quality assurance and improvement program.

11. Distribution, follow-up and risk acceptance

Follow up each action plan at its due date. Obtain evidence of implementation and, for high and critical findings, re-test the control before closing. Report overdue actions to the audit committee every quarter.

If management decides to accept a risk that the CAE believes exceeds the organisation's risk appetite, the CAE discusses it with senior management and, if not resolved, communicates it to the board or audit committee. Record the decision below.

Escalation is not a penalty for management. It ensures that the people accountable for the organisation's risk appetite make the decision with the facts in front of them. Record the reasons management gave, the compensating measures it relies on and the date when the acceptance will be reviewed again.

12. Supervision and quality review

Collect auditee feedback with a short survey after the final report and feed the results into the internal assessment described in the Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan).

13. Traceability matrix

Glossary and references

References (check the current official versions):

• The Institute of Internal Auditors, Global Internal Audit Standards (2024), effective 2025-01-09. Domain V (Performing Internal Audit Services), Principles 13, 14 and 15; Domain IV, Principles 11 and 12. Cited by number only; obtain the standards from the IIA.
• IIA Topical Requirements: Cybersecurity (effective 2026-02-05) and Third-Party (effective from September 2026 as reported in October 2026; check the date at theiia.org); apply them when an engagement covers those topics.
• US Government Accountability Office, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025-05-15, effective from fiscal year 2026.
• Related templates: Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan), Internal Audit Program, ISO 19011 (compliance/internal-audit-program), Control Testing Workpaper (compliance/control-testing-workpaper), Risk and Control Matrix (compliance/risk-control-matrix), Control Deficiency Evaluation (compliance/control-deficiency-evaluation), Fraud Risk Assessment (compliance/fraud-risk-assessment), Fraud Investigation Report (compliance/fraud-investigation-report), Audit Committee Report (finance/audit-committee-report), Whistleblowing Policy (compliance/whistleblowing-policy).

Standard and licence note

Structure aligned with the IIA Global Internal Audit Standards (2024, effective 2025-01-09), which are protected by copyright and are cited here by domain, principle and standard number only; no text from them is reproduced or paraphrased. Internal control criteria are based on the GAO Green Book 2025 (GAO-25-107721), a US federal work in the public domain, described in original wording. The template text, rating scheme, sample sizes and the Corvid Commerce Group example are original and fictional. Check the current official versions of the standards, any Topical Requirements and your internal audit manual before use. This is a document format, not legal, audit or accounting advice. Template licence: MIT.