A finance director often inherits an internal audit brief alongside a thin team, an inherited risk register and a methodology folder that no one has opened for years. The practical answer to what internal audit methodology is is straightforward: it's the documented way an organisation decides what to audit, sets the scope, gathers and tests evidence, reports conclusions, follows up actions and checks the quality of its own work.
For a UK SME or mid-market firm, the right methodology isn't a large corporate manual reduced in size. It's a defensible, usable framework that connects risk to evidence and evidence to decisions. The sections below set out how to build that framework against GovS 009, the Global Internal Audit Standards with UK interpretation and the Chartered IIA's public sector standards, while keeping the approach proportionate.
Table of Contents
- What an Internal Audit Methodology Does in Practice
- How UK Methodology Standards Have Evolved
- Risk-Based Planning and the Audit Universe
- Scoping an Engagement and Setting Objectives
- Testing Approaches for Controls and Transactions
- Sampling Logic for Internal Audit
- Working Papers That Withstand Scrutiny
- Reporting Findings and the Annual Opinion
- Quality Assurance and Improvement of the Methodology
- Worked Example of a Proportionate SME Methodology
- Quick-Reference Checklist for Building Your Methodology
- Common Questions and Where to Take It Next
What an Internal Audit Methodology Does in Practice
An internal audit methodology is the working system behind assurance activity. It normally includes principles, planning procedures, engagement templates, testing guidance, working-paper requirements, reporting rules, follow-up arrangements and quality checks. It should help an auditor make consistent decisions without turning professional judgement into a box-ticking exercise.
That makes it different from an audit charter. The charter establishes the function's purpose, authority, access rights and relationship with the board or audit committee. The methodology explains how the function exercises that authority on an individual assignment.
A useful methodology answers practical questions:
- What gets audited: how the audit universe is built and risk-ranked.
- Why it gets audited: how objectives link to organisational risks and control criteria.
- How it gets tested: which evidence, samples, walkthroughs and analytical procedures are appropriate.
- Who reviews it: how independence, supervision and quality assurance are protected.
- What happens afterwards: how findings, management actions and annual conclusions are tracked.
The value becomes apparent when an engagement file needs to be defended to an audit committee, a successor auditor, a regulator or a solicitor examining the basis for a conclusion. A methodology that only describes an audit cycle won't be enough. Each file should show a clear chain from risk, to objective, to evidence, to conclusion.
The practical principles described in what internal audit involves should therefore be converted into repeatable documents and review points. The methodology should be short enough for an auditor to use during fieldwork and detailed enough for an independent reviewer to understand the reasoning afterwards.
How UK Methodology Standards Have Evolved
UK internal audit methodology has developed from broad governance expectations into a structured, standards-based discipline. The Cadbury Report in 1992 recognised internal auditing as an essential part of good corporate governance, helping establish internal audit as a formal governance function rather than just a checking activity. The Turnbull Report in 1999 reinforced best practice for internal control in UK-listed companies and strengthened the relationship between control evaluation and risk management. The Chartered IIA records this development in its history of internal auditing in the UK.
For public-sector functions, the framework later became more consistent. The Public Sector Internal Audit Standards were first created in 2012 and became effective from 1 April 2013, giving public bodies a common standards base across the UK. That change mattered because it made methodology more visibly standards-led, with common expectations around planning, evidence, reporting and quality.
The next major reset took effect on 1 April 2025. UK public-sector bodies moved from PSIAS to the Global Internal Audit Standards with a specific UK application note, as explained in the Chartered IIA's public sector standards guidance. The current framework is organised into five domains, 15 principles and 52 standards, providing a formal structure for methodology design, conformance and quality reviews. That structure is also reflected in GovS 009 Internal Audit.
A methodology written before the current standards reset should be reviewed, especially its approach to annual risk-based planning, quality assessment, audit committee reporting and disclosure of conformance.
Risk-Based Planning and the Audit Universe
A proportionate methodology starts with an audit universe, not last year's schedule. The universe should list the organisation's auditable processes, legal entities, systems, projects and significant change programmes. For an SME, the starting material may be the organisation chart, general ledger, risk register, system list, prior findings and discussions with directors.
That initial list must then be challenged through a documented risk assessment. UK good-practice guidance expects the assessment to consider whether risks are complete, whether impact and likelihood criteria are suitable, how key risks are prioritised, and whether risk owners have the authority and resources to respond. Internal audit should form an independent view of emerging and systemic risks, while management consultation informs rather than determines the final plan. The UK audit strategy guidance sets out this emphasis.
A simple scoring model can work, provided its judgements are explained. The auditor can assess inherent likelihood and impact, evaluate the strength of relevant controls, and then determine the residual priority for audit coverage. The result should influence coverage and frequency, not create a false impression of mathematical precision.
Assurance mapping prevents duplicated work
An assurance map records who provides assurance over each material risk. It can include management reviews, compliance monitoring, external audit, specialist reviews and internal audit. This exposes gaps and prevents the internal audit plan from repeating work already performed by another function.
Readers seeking a broader introduction to structured risk practice may also find this risk management framework for Canadian SMBs useful for comparison, although UK organisations must apply their own governance and regulatory context.
For a smaller function, the methodology should state who challenges the scoring. A chief financial officer shouldn't both set the risk ranking and approve an audit conclusion over the same control without an independent review. A documented second review, co-sourced quality check or audit committee challenge can preserve objectivity. Lighthouse's risk assessment reporting service provides a relevant reference point when the risk profile needs to be formalised before the plan is approved.
Scoping an Engagement and Setting Objectives
A risk-ranked audit still fails if its scope is vague. GovS 009 requires an engagement to be planned around a documented risk assessment, clear objectives and scope, defined resources, evaluation criteria and a work programme before fieldwork starts. For an SME, a concise terms-of-reference document can satisfy that need without producing a long project pack.
The scope should identify the auditee, period under review, process boundaries, systems included, systems excluded, relevant inherent risks, intended level of assurance and any advisory limitations. Objectives should be written as risk questions rather than tasks. “Review invoices” describes activity. “Assess whether supplier onboarding and invoice processing prevent unauthorised or duplicate payments” describes an assurance objective.
Practical rule: If an auditor can't explain what is outside the scope, the scope isn't finished.
Terms-of-reference elements aligned to GovS 009
| GovS 009 element | Template prompt | Acceptable evidence |
|---|---|---|
| Objectives | Which risks and control questions must the engagement answer? | Approved objective statement and risk linkage |
| Scope | Which entities, systems, transactions and dates are included or excluded? | Boundary schedule and exclusions |
| Resources | Which skills, time and specialist input are required? | Assignment plan and resource approval |
| Evaluation criteria | What should the process achieve, and against which policy or control standard? | Policies, procedures, delegated authorities and other agreed criteria |
| Work programme | Which tests will answer each objective? | Approved test programme linked to risks and controls |
The CAE or responsible audit lead should approve the brief before fieldwork, and management should acknowledge the practical boundaries. That sign-off protects both sides from scope creep. For readers improving control records alongside audit planning, control documentation and remediation tips offer useful supplementary context.
Testing Approaches for Controls and Transactions
Walkthroughs come first. An auditor traces a transaction or activity from initiation to recording, approval, processing and reporting. The walkthrough confirms how the process works, identifies control points and reveals differences between written procedures and operational practice.
Design testing asks whether a control is capable of addressing the stated risk. Operating-effectiveness testing asks whether the control operated consistently during the relevant period. The two conclusions must stay separate. A well-designed approval control that wasn't performed is a failure of operation, while a consistently performed control that doesn't address the risk is a design failure.
Hypothetical purchase-to-pay example
A purchase-to-pay review might trace a requisition through purchase order approval, goods receipt, invoice matching and payment. Key controls could include a three-way match, segregation of duties and restricted supplier-master maintenance.
The auditor would first compare the documented process with the risk. Design testing would assess whether the approval hierarchy, matching rule and access restrictions address unauthorised purchasing, fictitious suppliers and duplicate payments. Operating-effectiveness testing would then examine selected transactions and inspect evidence that each control fired during the period.
Substantive testing becomes more relevant where controls are absent, weak or unreliable, especially in fraud or irregularity work. It may involve checking the underlying transaction, recalculating amounts, confirming occurrence or tracing entries to source evidence. A payroll review may reveal that a system restriction is missing, but a compensating review by an independent manager detects changes to bank details. The working papers must record that relationship, rather than labelling the first control failure as the full conclusion.
A short visual explanation can help non-auditors understand how these testing stages relate:
Sampling Logic for Internal Audit
Sampling should follow the testing objective. Judgemental sampling is appropriate when the auditor deliberately selects higher-risk, unusual or material items. Statistical sampling is appropriate when the auditor needs a defensible basis for drawing a conclusion about a population and wants sampling risk to be explicitly considered.
Attribute sampling tests whether a control characteristic is present, such as evidence of approval. Discovery sampling is used where the auditor is looking for evidence that an error or exception exists and needs a structured approach to detection. Neither method removes judgement. The population must be complete, the selection must be reproducible and exceptions must be assessed against the objective.
Choosing a sampling method in internal audit
| Testing objective | Recommended method | Sample-size driver | Working-paper line |
|---|---|---|---|
| Existence | Directed or substantive testing | Risk, value and unusual characteristics | “Selected items were traced to supporting evidence.” |
| Completeness | Population reconciliation and targeted testing | Reliability of the population and expected gaps | “The population was reconciled to the source record.” |
| Accuracy | Substantive or attribute testing | Materiality, risk and expected error | “Amounts were recalculated against agreed criteria.” |
| Occurrence | Attribute, discovery or directed testing | Fraud indicators, control reliance and exception tolerance | “Selected transactions were assessed for genuine business purpose.” |
Two shortcuts are legitimate for smaller organisations. If the population is small enough, test every item. If risk is concentrated, stratify the population, for example by high-value suppliers or payroll leavers, and test the higher-risk group separately.
Working papers should state the population definition, selection method, confidence chosen where statistical sampling is used, expected error assumptions where relevant, and how sampling risk affects the conclusion. If a finding is extrapolated, the file should explain the basis and limitations rather than presenting the result as a full-population fact.
Working Papers That Withstand Scrutiny
A working-paper file must make sense to someone who wasn't in the room. It should contain the terms of reference, risk and scoping analysis, control matrix, approved test programme, evidence obtained, test results, findings, management responses, conclusion and review trail.
Each paper needs a unique reference. The preparer and reviewer should be identifiable, with dates, and the conclusion should point directly to the supporting evidence. Cross-referencing matters because it allows a reviewer to move from a reported finding back to the failed control, the selected item, the source document and the evaluation criterion.
A lean file still needs a complete chain
A smaller function can use fewer templates, but it can't omit the reasoning chain. The file should answer:
- What risk did the engagement address?
- What control or criterion was examined?
- What evidence was selected and why?
- What exception was identified?
- How did the auditor reach the conclusion?
- Who reviewed and approved the work?
Confidential storage is essential whether records are physical or held in a secure audit management system. Access should reflect the sensitivity of personnel, supplier, fraud and commercially confidential information. Retention should follow the applicable standards, organisational policy and legal hold requirements. The Chartered IIA's public-sector materials and the current standards framework should be checked when setting the retention rule, rather than relying on an inherited folder convention.
The same discipline applies to information-security assurance. Readers documenting an information-security control environment may find these certification steps for ISO 27001 useful, although certification work and internal audit evidence serve different purposes.
Reporting Findings and the Annual Opinion
Reporting should convert testing into a decision. The auditor normally discusses emerging findings with management, issues a draft for factual clearance, records the response, finalises the report and transfers agreed actions to a follow-up tracker. Factual clearance should correct errors in description, not remove a supported conclusion merely because it is uncomfortable.
A strong finding separates condition, criterion, cause and consequence. The condition states what happened. The criterion states what should have happened. Cause explains why the gap exists, and consequence describes the exposure in terms the board or management can act on. The recommendation should have an owner and target date, with management's response recording whether the action is accepted, amended or rejected.
Five-part finding structure
| Component | What it answers | Weak version to avoid |
|---|---|---|
| Condition | What did the audit observe? | “Controls need improvement.” |
| Criterion | What requirement or expected practice applies? | An unstated standard |
| Cause | Why did the gap arise? | Blaming an individual without analysis |
| Consequence | Why does the issue matter? | Vague references to “risk” |
| Recommendation | What should change, who owns it and by when? | “Management should strengthen controls.” |
The annual opinion is not a guarantee. It should state the work performed, the basis for the conclusion, limitations in coverage or evidence, and the overall assessment of governance, risk management and control. Confidence must reflect the scope and quality of assurance, with material limitations disclosed clearly.
A report should be concise without being superficial. Audit report writing guidance is relevant where findings need to be presented clearly to an audit committee, directors or other decision-makers.
Quality Assurance and Improvement of the Methodology
Quality assurance distinguishes a documented methodology from a defensible one. The current standards framework expects internal audit functions to monitor and improve performance through ongoing monitoring, periodic self-assessment and external assessment.
Ongoing monitoring operates at engagement level. It includes supervision, review of working papers, sign-off, monitoring of delivery and post-engagement feedback. It corrects weaknesses while an assignment is still fresh.
Periodic self-assessment tests whether the methodology and function conform to the applicable standards. It should examine planning, independence, evidence, reporting, follow-up and the basis for the annual opinion. It identifies systemic weaknesses that individual engagement reviews may miss.
External assessment provides independent challenge and credibility. The methodology should provide for an external assessment at least once every five years, conducted by an independent reviewer. A smaller function might use a qualified independent assessor or a structured peer review through a shared service arrangement, rather than commissioning an unnecessarily elaborate benchmarking exercise.
The results should be reported to those charged with governance and linked to a dated improvement plan. The audit committee should be able to see not only whether audits were completed, but whether the methodology itself was tested, weaknesses were identified and changes were made.
Worked Example of a Proportionate SME Methodology
The following is hypothetical. Northgate Components Ltd is a UK manufacturer with 140 people. Its annual risk assessment ranks procurement as a priority because supplier onboarding and duplicate-payment controls have changed during a system transition.
The audit universe records procurement as one auditable area, but the terms of reference narrows the engagement to supplier onboarding and duplicate payments. The auditor excludes contract performance and inventory, defines the review period, sets the evaluation criteria and documents the available resource. A judgemental sample of 25 invoices is selected because the review is directed at higher-risk transactions and unusual payment characteristics, not intended as a statistical estimate of the entire population.
Working papers link each test to the risk and retain supplier records, approval evidence, matching results and duplicate-payment analysis. The draft report contains two findings, each with an owner, action and target date. The finance director accepts that a wider sample would provide more evidence, but chooses a focused review to limit management disruption and preserve time for remediation.
| Stage | Elapsed days | Auditor hours | Management touchpoints |
|---|---|---|---|
| Risk confirmation and scope | 2 | 6 | Opening discussion |
| Walkthrough and evidence request | 3 | 10 | Process interview |
| Testing and analysis | 6 | 24 | Clarification meeting |
| Draft report and clearance | 3 | 8 | Draft review |
| Final report and follow-up setup | 2 | 4 | Action agreement |
This is proportionate because the file still shows risk, scope, criteria, evidence, judgement and review. It doesn't copy a large-function manual, but it doesn't sacrifice the logic required by the current UK framework.
Quick-Reference Checklist for Building Your Methodology
A finance director can adapt the following as a one-page control document:
- Mandate: Record purpose, authority, access and reporting lines, as covered in “What an Internal Audit Methodology Does in Practice”.
- Independence safeguards: State conflicts, prohibited management responsibility and review arrangements.
- Risk-based plan: Maintain the audit universe, risk assessment, plan and assurance map.
- Terms of reference: Define objectives, boundaries, resources, criteria and approval.
- Control testing: Separate walkthrough, design and operating-effectiveness conclusions.
- Sampling approach: Document population, selection, rationale and sampling risk.
- Working-paper standard: Require references, evidence, conclusions and review dates.
- Reporting protocol: Set rules for clearance, findings, responses and escalation.
- Annual opinion: State scope, basis, limitations and overall conclusion.
- Quality assurance: Include monitoring, self-assessment and external assessment arrangements.
- Stakeholder feedback: Record useful feedback without allowing it to override audit judgement.
For public-sector bodies, each item should be mapped to GovS 009 and the current Global Internal Audit Standards with UK interpretation. Private-sector organisations can use the same logic, adjusted for their governance structure and regulatory obligations.
Common Questions and Where to Take It Next
How much methodology is enough for a 50-person firm?
Enough to make decisions repeatable and conclusions defensible. A short manual with an audit universe, risk assessment, engagement brief, testing standard, file index, reporting template, follow-up tracker and quality review schedule is usually more useful than a large template library no one uses.
Does PSIAS still apply after the 2025 reset?
UK public-sector bodies moved to the Global Internal Audit Standards with UK interpretation for engagements conducted from 1 April 2025, as set out in the relevant UK application note. The precise obligations depend on the body and its sponsoring framework, so the methodology should identify the governing standard rather than assume that an old PSIAS reference remains sufficient.
Can a co-sourced auditor use the organisation's methodology?
Yes, provided the engagement terms define responsibility, access, confidentiality, review and ownership of conclusions. The application note covers internal audit service providers including in-house, shared-service and outsourced functions, so the methodology should apply consistently regardless of delivery model.
What evidence will an audit committee expect?
It will normally expect a risk-based plan, approved scopes, intelligible working papers, clear findings, management actions, follow-up status, quality-assurance results and an annual opinion that explains limitations. It shouldn't have to reconstruct the auditor's reasoning from scattered emails.
When should a small function consider outsourcing?
Outsourcing becomes sensible when independence can't be protected internally, specialist expertise is unavailable, the risk profile has changed materially or quality assurance requires an independent assessment. Lighthouse's internal audit services can be considered alongside an in-house or co-sourced model. The relevant choice depends on the audit charter, risk register, confidentiality requirements and available resource.
Lighthouse Consultants can also support related work where the methodology identifies a need for risk assessment or a separately scoped fraud response. Fraud investigation shouldn't be treated as routine assurance. GOV.UK guidance says internal auditors should investigate suspected or actual fraud or corruption only where they have the appropriate expertise and understanding of relevant law, and management should be told when the work falls outside the core internal audit remit and may affect the audit plan. That is why any investigation should be separately scoped, resourced and documented.
Lighthouse Consultants can help UK SMEs and mid-market firms design or refresh an internal audit methodology, build risk-based plans, prepare working-paper templates and perform quality-assurance reviews. Visit Lighthouse Consultants to discuss the organisation's audit charter, risk register and resource constraints, then book a proportionate conversation at Lighthouse Consultants.
