Most organizations have established operational standards, objectives, metrics and expectations, which are operationalized through procedures and work instructions. If these exist, then the value added auditor can use these as a metric to conduct an audit.
The internal auditor determines whether the business objectives, standards, metrics, processes and work instructions are acceptable to meet audit objectives and then determine if they are being met.
But, what does the internal auditor do if there are no technical, procedures, policies, specifications, standards, or other types of documents? Continue reading