Taking a holistic view in internal audit means understanding the entirety of a process from start to finish, including its various interconnections and implications. This approach involves thoroughly comprehending the activities involved, the individuals responsible, and the broader impact on the organization. By mapping out the complete beginning-to-end cycle of a process, auditors gain insights into potential vulnerabilities and opportunities for fraud.
The first step when conducting an internal audit is to thoroughly understand the process being audited. The internal auditor must:
- Identify various steps in the process, people responsible, and data available at each stage.
- At each step, identify the potential fraud risk factors.
- Determine where controls need to be implemented.
- Evaluate whether the management implemented them and if they are functioning effectively.
Gaining a Comprehensive Understanding
For instance, when auditing preventive maintenance expenditure, understanding the process involves delineating steps such as:
- Annual Maintenance contract (AMC) is entered into with service providers (Procurement and Maintenance teams).
- According to the defined periodicity of service in contract, a preventive maintenance calendar is prepared and used as a monitoring tool to ensure timely maintenance (Maintenance team).
- Once the service is performed, preventive maintenance sheet containing areas / aspects to be verified is signed off by both the vendor and organization team (Maintenance team).
- This sheet is submitted to Finance team for recording the same in Accounts and processing the payment to vendor (Finance team).
During the internal audit, data validation plays a crucial role, especially given the reliance on extensive datasets. For example, in examining the preventive maintenance calendar, internal auditors may encounter incomplete or missing information indicating discrepancies in scheduled maintenance. Instead of hastily concluding, a holistic view prompts auditors to delve deeper. If there are invoice and payment entries, it implies that maintenance has been conducted. Otherwise, bigger issue is invoice was raised and payment was processed without conducting the maintenance service.
See also, “Internal Audit’s Increasing Role in Hunting for Fraud.”
This comprehensive understanding enables auditors to identify whether the issue is inaccurate calendar updates, or serious fraudulent invoicing, or service duplication. The potential issues could be absence of timely update of preventive maintenance calendar, or vendor invoices are raised and processed without any actual service, or availing service from vendor despite the same being covered in AMC, or vendors other than AMC vendors have provided service resulting in additional costs.
Follow the Interconnections
Hence, in the above example, in addition to understanding the process, the auditor must also establish connections across various steps or how each step relates to the other. For example, the preventive maintenance calendar is derived from the contract and the data in the calendar can be verified by examining the contracts. The completion of preventive maintenance services can be verified by checking the actual dates in the calendar, or by reviewing vendor invoicing and payment entries.
The holistic view empowers auditors to assess controls effectively by uncovering potential fraud scenarios at each stage of the process. By recognizing the interconnectedness of activities and dependencies within a process, auditors can better identify control weaknesses and recommend appropriate measures to mitigate risks. This approach not only enhances the effectiveness of internal audits but also strengthens organizational resilience against fraud and operational inefficiencies. 
Akhila Srirangam N C. is an internal auditor with more than seven years of experience conducting Internal audits and SOX assignments across various industries in Mumbai, India.