Over-auditing of internal audits

A common internal auditing problem is to continually return to a specific area to conduct yet another audit, usually because there has been an historical concern that this area presents the most risk to the business. However, a repetitive series of audits very nearly ensures that each successive audit will be conducted in exactly the same manner as its predecessor, since it is most efficient to copy the work procedures followed by the last audit team.

A result of this process is that certain areas are over-audited, with the same audit tasks being repeated time and again. The original intent of an audit procedure might have been to test an area just once, not that it be repeated many times.

A more effective alternative is to keep preceding work in mind when developing the work plan for a new internal audit, but to create an entirely new audit plan for every engagement. It will take longer to create a new work plan than to copy an old plan, but the result may be new audit procedures that will uncover issues in entirely different areas.

The creation of a new work plan should include the opinions of everyone scheduled to work on the engagement, in order to uncover different control risks that could be tested, as well as to build buy-in to the new plan. Also, continually engaging in new types of audit tests makes the work more interesting for the audit staff, which may limit the temptation to leave their positions for other types of work.