An internal audit, end to end
A case study proves a problem can be found. This is the process built to find problems on a schedule, before someone else does, worked in full against a fictional company, from scoping to closure.
The case studies elsewhere on this site show what happened when a specific control failed and I fixed it. That's evidence of judgement, but a recruiter for an internal audit role is usually asking a narrower question: have I actually run the audit cycle itself, not just benefited from someone else running it? Scoping, risk-based planning, control objectives, test procedures, evidence standards, findings and ratings, management actions, follow-up testing, closure and residual risk.
So here it is, worked end to end, against a fictional mid-sized distribution company invented for this purpose. The audit discipline is the same one behind a real Fleet Logistics Inspection: sample-based testing against defined control objectives, findings graded on a fixed scale, actions owned and dated, and nothing closed until someone independent of the finding checks it.
The Audit Cycle
Northfield Distribution Ltd (fictional)Audit Scoping
Scope is agreed and fixed before testing starts, so findings can't later be dismissed as "not what we meant" and the audit can't quietly expand into areas nobody resourced it to check.
Scope Statement (illustrative)
- Objective: assess whether inventory, custody and supplier-onboarding controls at Northfield's Midlands distribution site are operating as designed
- Period covered: the preceding twelve months of transactions and records
- In scope: stock accuracy, custody transfer between shift handovers, purchase authorisation, new supplier onboarding
- Out of scope: IT general controls and payroll, both covered by separate, concurrently scheduled reviews
- Authority: commissioned by the Audit & Risk Committee under the annual risk-based audit plan
Risk-Based Audit Planning
Not every control gets the same depth of testing. Planning sets that depth deliberately, based on what the control is actually protecting against, rather than auditing everything to a uniform, shallow standard.
Categorisation Used
- Governance: activity the business is contractually or legally bound to control, such as financial authorisation limits. Non-negotiable; always tested.
- Assurance: activity that enables the operation to function, such as stock accuracy feeding accurate customer commitments. Tested to a risk-based sample.
- Compliance: internal procedural checks against the company's own policy. Sampled at the auditor's discretion, weighted towards areas with prior findings or recent change.
Sample sizes were set higher for Governance items (near-total population) and lower for Compliance items (risk-weighted sample), with the sampling rationale documented before testing began, not adjusted afterward to fit what was found.
Control Objectives
Each objective states what risk the control addresses, before any testing happens, so it's clear what "pass" and "fail" actually mean.
| Control Objective | Risk Addressed | Category |
|---|---|---|
| Inventory Accuracy | Stock records used for customer commitments and financial reporting don't reflect physical reality | Assurance |
| Custody Transfer | No one is accountable for stock discrepancies that occur during a shift or role handover | Governance |
| Purchase Authorisation | Spend above delegated limits is committed without appropriate sign-off | Governance |
| Supplier Onboarding | A new supplier is transacted with before being screened for sanctions, financial stability or compliance history | Compliance |
Test Procedures
How each objective was actually tested, not just what was tested. This is the part a checklist alone doesn't show.
| Control Objective | Test Procedure | Sample |
|---|---|---|
| Inventory Accuracy | Independent physical recount of a sample of stock lines, reconciled against the system record | 25 lines, Category A stock |
| Custody Transfer | Walkthrough of handover documentation, checking for dual signature and date | 5 handover records |
| Purchase Authorisation | Re-performance check: trace each transaction above threshold to its authorisation record | 15 transactions above £500 |
| Supplier Onboarding | Document review confirming screening evidence exists and predates first transaction | 8 new suppliers onboarded in period |
Evidence Standards
Not everything offered as evidence counts as evidence. The standard was fixed before testing, not negotiated finding by finding.
Accepted as Evidence
- Dated and signed records, retained in the file at the time, not reconstructed for the audit
- Independently verifiable output: a system report, a physical count, a third-party confirmation
- Something checked by someone other than the person whose work is being evidenced
Not Accepted as Evidence
- Verbal assurance with nothing retained in writing
- Self-certification with no independent check
- A record produced after the fact and dated to match the period under review
Findings & Ratings
Every finding is graded on a fixed three-point scale, applied the same way regardless of who's affected by the result.
Rating Scale
- control operating as designed, no action required
- control operating but with a gap that needs correcting
- control not operating, or operating in a way that doesn't manage the risk
| Ref | Objective | Finding | Rating |
|---|---|---|---|
| F1 | Inventory Accuracy | 3 of 25 sampled lines showed a system-to-physical variance with no adjustment record on file | |
| F2 | Custody Transfer | 1 of 5 sampled handover records lacked a countersignature from the receiving custodian | |
| F3 | Purchase Authorisation | All 15 sampled transactions above threshold had appropriate dual authorisation on file | |
| F4 | Supplier Onboarding | 2 of 8 new suppliers had no evidence of screening prior to first transaction |
Management Actions
A finding without an owned, dated action is an observation, not a managed risk. Every rating below Full Compliance gets a tracked action.
| Ref | Root Cause | Action | Owner | Target | Status |
|---|---|---|---|---|---|
| F1 | Adjustment step skipped after recount when variance was small | Investigate the 3 lines, raise adjustment records, brief the team on the adjustment step | Warehouse Manager | +30 days | Open |
| F2 | Handover procedure not consistently enforced on night shift | Reissue handover procedure; retrospectively verify or re-perform the affected handover | Operations Supervisor | +14 days | Open |
| F4 | Onboarding gate control not enforced before first transaction is permitted | Screen the 2 suppliers retrospectively; suspend further transactions pending clearance; add a system block preventing transactions before screening is recorded | Procurement Lead | +7 days, escalated | Open, escalated |
Follow-Up Testing
The first question of any audit is whether last time's findings actually got fixed. An action marked "closed" by the person who owned it is a claim waiting to be tested, not a fact.
Illustrative Follow-Up
Prior audit (twelve months earlier) raised a Partial Compliance finding on stocktake reconciliation timeliness: reconciliations were being completed outside the 30-day policy window on a majority of sampled cycles.
Retest this period: 9 of 10 sampled reconciliation cycles completed within the 30-day window. Evidence: dated reconciliation records cross-checked against the stocktake calendar.
Result: upgraded from Non-Compliance to Partial Compliance. Retained on the tracker, not closed, because the standard is 10 of 10, not 9.
Closure & Residual Risk
Closure is a decision, not a formality, and it's made by someone who didn't own the finding.
Illustrative Closing Position
- Overall opinion: Limited Assurance. Core financial controls (purchase authorisation) are operating effectively; operational controls (inventory, custody, onboarding) have gaps that are known, owned and being actioned
- Residual risk: until F4 closes, Northfield carries uncontrolled counterparty risk on two live supplier relationships; this has been flagged to the Risk Committee as the priority item, not buried in the general finding count
- Independent verification: closure of each action is confirmed by a reviewer who did not own the finding, evidenced separately from the action owner's own sign-off
- Next audit: all open actions retested at the next scheduled visit; anything still open past two cycles is escalated automatically, not left to individual judgement
What this demonstration is not
It's not a real audit report, and Northfield Distribution Ltd doesn't exist. The figures, findings, and dates are constructed to be realistic and internally consistent, not copied or adapted from any actual engagement, client, or organisation I have worked with.
It's also not a claim to hold a professional audit qualification. It's a demonstration that I understand the full cycle, sourced from the same discipline that runs real Fleet Logistics Inspections: risk-based scoping, defined evidence standards, graded findings, owned actions, and closure that someone independent has to sign off.
Where this comes from
The rating scale, the categorisation into Governance, Assurance and Compliance, and the discipline of never letting the person who caused a finding also close it, are the same ones described in more detail in The Three Lines of Defence: From Warships to AI. This page is that discipline applied forward, end to end, against a single worked example rather than described in the abstract.