Using internal evidence to strengthen internal audit

A reasoned conclusion on using internal evidence to strengthen internal audit should reconcile the governing expectation, evidence of operation, learner outcomes and unresolved risk. A selected successful case is not sufficient. Arrangements for corrective action should provide accurate information, timely support and an accessible route for correction or review without adverse treatment.

Application to internal audit

Data used for using internal evidence to strengthen internal audit should be interpreted against stable definitions and an identifiable population.

In examining using internal evidence to strengthen internal audit, risk assessment for corrective action should consider severity, reach, duration, recurrence and detectability, with escalation where learner impact may be material.

Review of internal audit should follow a stated and reproducible method. The record for the intended improvement should identify the responsible function, decision authority and escalation route.

Implementation of corrective action should be organised around a decision that can be tested. Review of corrective action should give particular attention to adverse cases, unequal effects and errors that learners may be unable to identify or remedy after the event. Governance of the intended improvement requires a clear allocation of authority, information and follow-through. For internal audit, escalation should place material evidence before the authority capable of an effective response.

For internal audit, completion should depend on evidence of effect rather than completion of planned activity. Material concerns include governing bodies receiving activity data instead of outcome evidence, management assurance accepted without testing, material risks omitted from reporting, and conflicts not identified. Materiality depends on the consequence and extent of an exception, not only on how often it appears in sampled records.

Reporting on the intended improvement should distinguish established fact, analytical judgement and planned action. When examining internal audit, material revisions should retain their reason and effective date. At the publication date, Independent assurance within education providers provides the relevant international context for corrective action. Any consequential application still requires evidence from the affected jurisdiction or institution.

Controls for internal audit

Implementation of internal evidence to strengthen internal audit can be tested without imposing unnecessary reporting. Review of the corrective action should map the complete process, identify the intended result and responsible authority at each stage, and test normal cases together with exceptions. Corrective action concerning using internal evidence to strengthen internal audit should address the identified cause, assign responsibility and set a review period. Residual risk should remain open until sustained improvement is demonstrated.

The record for the matter should identify the responsible function, decision authority and escalation route.

When examining internal audit, analysis should remain within the limits of the evidence. For the intended improvement, governance structures do not provide assurance merely because committees exist.

The assurance record for internal audit should retain the date of the evidence, the source responsible for it, the scope examined and the version of any instrument or definition applied. Corrective action concerning the intended improvement should address the identified cause, assign responsibility and set a review period. For internal audit, revision should not remove an earlier conclusion from the record where reliance has occurred.

Neither one indicator nor one control can establish the complete position on the matter. The principal risks associated with the matter should be assessed as connected conditions.