Build audit readiness into routine work.

About narration

Uses speech voices provided by your browser or device. Availability, quality and online processing depend on that service.

Start with a transaction, not a document request.

A finance team can produce a large folder of invoices and still be unable to explain why a supplier was paid. The missing link may be the receipt of goods, a change to bank details or approval by someone with the right authority. Audit preparation should expose those gaps early.

Take a recent purchase from request to payment. Match the order, delivery evidence, invoice, approval and bank entry. Ask where the records are held and who can retrieve them. A complete example establishes the expected evidence trail. A broken example identifies a problem the process owner can investigate before it spreads.

Distinguish a clean balance from a sound process.

South Africa's Auditor-General reported that 65 municipalities had an unqualified audit opinion in 2023/24 but missed a clean audit outcome solely because of compliance findings. That distinction matters when interpreting public-sector results. ^[1]

It does not mean a private company should adopt municipal reporting rules. It shows why one favourable conclusion should not be treated as proof that every control is working. Management should distinguish financial accuracy, compliance with applicable requirements and operational performance. Each needs appropriate evidence and a clear owner.

Specify the evidence at the point of work.

For every important control, identify its purpose, performer, frequency and retained record. A bank reconciliation needs an explanation of unresolved items and evidence of review. An access review needs the users checked, decisions made and removals completed. A signature alone may show neither.

Design the record so it can be completed during the work. If employees must reconstruct it weeks later, the process encourages omissions. Establish a shared filing convention and appropriate access restrictions. In a group with South African and Congolese operations, preserve the source record and make any translation or currency conversion traceable to it.

Keep management and assurance responsibilities clear.

The IIA's Global Internal Audit Standards were issued in 2024 and became effective in January 2025. They guide the professional practice of internal auditing. ^[2]

Management remains responsible for operating its controls and addressing failures. Internal audit can assess those arrangements and follow up findings; it should not be treated as the team that creates missing approvals after the event. Statutory audit requirements, professional eligibility and the scope of an engagement must be established separately. Preparing a file does not establish compliance with a professional standard or guarantee an audit opinion.

Close the cause of a finding.

Suppose a review finds repeated supplier payments without proof of receipt. Uploading a document for the sampled items may answer the immediate query but leave the process unchanged. Establish whether receiving staff lack access to the system, responsibility is unclear or the payment team can override a mandatory check.

Agree a remedy, an owner and a date. Test a later transaction to confirm that the remedy works. Keep unresolved issues visible, including any temporary control and its limits. A short monthly review of recurring exceptions gives management better evidence of progress than a long list marked complete just before year-end.

A question for your team

Can we show that a control worked before the auditor asked for evidence?

Sources & notes

Sources checked on 29 October 2026. This article presents our analysis of the cited research and its implications for businesses. Numbered references link to the original sources.