There are four different audit steps followed in every financial or system audit: planning and risk assessment, testing of internal controls, substantive procedures, and finalization. The purpose of these audit steps is to provide a standard process that is used in every audit. In most organizations, an audit is conducted by the internal audit department or an external auditing or accounting firm.
Planning and risk assessment audit steps are typically conducted before the fiscal year end and are used to gather information. The auditor takes the time to learn about the industry, regulations, accounting policies, and information systems. During this stage, many auditors work from a remote location, as most of this information is available from independent sources.
In order to effectively plan the audit, the overall scope must be evaluated and documented. A standard financial audit is limited in scope to transactions that occurred in the current period and is often completed at a summary level. The number of transactions and dollar values are used to determine the upper and lower bounds that will be used to set the audit values. The industry, strength of internal controls, and any issues raised by management determine the risk assessment for the audit.
One of the most important of all the audit steps is the process of testing the internal controls. These processes and procedures are used to ensure that proper approvals are in place before payment is made or transactions entered in the system. The primary method of internal control testing is to randomly select transactions and check the source documentation. If a random selection from a representative sample finds controls were weak or missing, then the sample size must be increased.
Substantive procedures is the actual process of collecting physical evidence of transactions and verifying the value posted to a specific account is supported by actual documents. This aspect of the audit is the most time consuming and is very detailed work. The account selected for this type of review varies, but is typically one that tracks a range of high and low dollar value activity.
The last stage of the audit is finalization. This is the creation of a report to management that summarizes all the procedures used to conduct the audit, the result of the various processes, and supporting documentation. Audit reports have a variety of formats or layouts used, depending on the audience. For example, most banks require audited financial statements when applying for a business loan. They often have a preferred format, making the comparison and review a simpler process.