Day-to-day operating brief
What Internal Auditor work looks like in practice
An Internal Auditor evaluates governance, risk and internal controls across departments, projects or subsidiaries. Unlike an external financial-statement audit, the role follows a risk-based internal plan and reports findings to management or an audit committee. Terms should define functional independence, information access, travel, investigation boundaries, working papers, report review, action follow-up, conflicts and protection from operational interference. Follow-up should test whether remediation addresses the finding's cause, not merely whether management marked an action complete. Advisory work needs safeguards so later auditors can remain objective. Urgent investigations should still preserve scope authority, evidence access and fair reporting of limitations. Audit reports should connect findings to risk, cause, consequence and proportionate action rather than list procedural deviations alone. Management can then challenge facts while the committee still sees why the issue matters. Confidential interview notes should preserve factual evidence and agreed attribution, giving staff a clear distinction between background context and statements intended to support a formal finding. Data extracts should be retained with selection parameters so later review can reproduce the population tested.
Individually written and reviewed against the maintained role record.