Internal audit jargon, translated: what is an audit finding, a charter and a control self-assessment?

Internal audit jargon, translated: what is an audit finding, a charter and a control self-assessment?

Internal audit has its own vocabulary, and the same words are often used loosely. This guide defines an audit finding, a control self-assessment and an internal audit charter, then covers the audit plan, evidence, sampling and analytics in brief.

What is an audit finding?

An audit finding is a documented conclusion that compares what was found with what should have been happening. It records a gap, weakness or issue, supported by evidence, so management can fix it. Findings can also record good practice.

Element	What it answers	Example
Criteria	What should be happening?	Leavers’ accounts must be disabled within 24 hours
Condition	What was found?	12 of 40 sampled leavers kept active accounts for more than 7 days
Cause	Why did it happen?	HR does not tell IT when a contract ends early
Effect	What is the risk?	Former staff could access sensitive data
Recommendation	What should change?	Automate leaver notifications from HR to IT
Management response	Who will act, and by when?	IT service owner, by the end of next quarter

Most teams rate findings as high, medium or low, with good practice for what works well, so leaders can focus on what matters most. Every finding needs evidence someone else could check, a root cause rather than just a symptom, and facts agreed with the area audited before the report is issued. Each action then needs an owner and a due date, and overdue actions and repeat findings go to the audit committee.

Findings are only useful if they are tracked to closure. Internal audit teams usually keep findings, actions and owners in one register and link them to the risk register so audit and risk teams work from the same picture. Ideagen’s internal audit solution supports this workflow, from risk-based planning and control testing through to action tracking and stakeholder reporting.

What is a control self-assessment?

A control self-assessment (CSA) is a process in which the people who run a control assess how well it works, instead of an auditor testing it. The Institute of Internal Auditors (IIA) has long recognized CSA as a way to increase risk awareness in the business.

Common methods include facilitated workshops, questionnaires, management-produced analysis and attestation. CSA brings risk thinking closer to the people doing the work and spots problems between audits. The limit is that owners may rate their own controls too generously, so results need independent challenge, such as sample testing, and consistent scoring.

CSA is only as good as the list of obligations and controls behind it. Ideagen’s regulatory compliance solution maps policies to the regulations that apply and flags the policies affected when a regulation changes, which supports keeping that list current. Control owners still judge whether each control works.

What is an internal audit charter?

An internal audit charter is a formal document, approved by the board, that sets out the purpose, authority, responsibility and independence of the internal audit function. It lets internal audit work independently and gives it access to the people, records and systems it needs.

The Global Internal Audit Standards from the IIA expect a charter that is reviewed periodically and approved by the board. UK public sector bodies follow the application note for the standards, so check the current guidance for your sector.

A charter typically covers the mandate, authority, independence, scope, responsibilities, reporting lines to the board and the standards followed. The head of internal audit drafts it, the board or audit committee approves it and the function reviews it regularly. Keep it short, written in plain language and explicit about what internal audit will not do, such as taking on management decisions.

A charter sets the rules, but the function still has to show it meets them. Ideagen’s internal audit solution maps audit activities to the Global Internal Audit Standards and keeps the documentation in one place, so teams can show their work follows the charter.

Audit plans, evidence, sampling and analytics

What is an audit plan?

An audit plan is the schedule of audits a function intends to carry out, usually over a year. A risk-based plan ranks the audit universe by risk and time since the last audit, then matches audits to the available people and days. The board or audit committee normally approves it.

What is audit evidence?

Audit evidence is the information an auditor collects to support findings. It has to be relevant, reliable and enough that another auditor would reach the same conclusion. Types include documents, observation, inquiry, re-performance, data analysis and system logs, and independent evidence is generally more reliable than information from the area being audited.

What is audit sampling?

Audit sampling is testing less than 100% of a population and using the results to reach a conclusion about the whole. Statistical sampling gives a measured level of confidence, judgmental sampling targets known risk areas and targeted testing covers every high-risk item. Every exception is recorded, and testing is extended if exceptions exceed expectations.

What is audit analytics?

Audit analytics is the use of data analysis tools to test whole datasets rather than samples, for example to find duplicate payments, conflicting access rights or transactions just below approval limits. An auditor still has to investigate each exception to confirm it is a real issue.

How the terms fit together

The charter gives internal audit its mandate and the plan sets the work. Sampling, analytics and evidence produce the findings, and control self-assessment adds management’s view between audits. Together they make up the audit cycle: risk-based planning, control testing, reporting and follow-up.