Audit engagements
Internal Audit → Audit Engagements
Before your first engagement, check Audit settings — capacity, risk factors, regulatory regimes, quality criteria and remediation reminders all shape what an engagement can do.
An audit engagement runs through eight tabs, roughly in order.
| Tab | What you do there |
|---|---|
| Overview | Scope, dates, budget, team. |
| Milestones | The ceremonial gates — announcement, RCM approval, closing meeting. |
| Program | RACM procedures: what will be tested and how. |
| Requests | Information requested from the auditee, and what came back. |
| Workpapers | The fieldwork itself, one per procedure. |
| Findings | Observations, management responses, agreed actions. |
| Report | The structured report and audit opinion. |
| Quality | QAIP review against IIA criteria. |
Milestones and the two-person gate
Some milestones — planning memo approved, RCM approved by the Chief Auditor, final report issued — carry a shield icon. They require two different people: one to complete the work, another to approve it.
Open the milestone and you will find a segregation-of-duties panel:
- Implemented by — who did the work. Set this first.
- Approved by — who is attesting. The list excludes the implementer.
- Mark approved.
The approver control stays locked until an implementer is recorded. A milestone nobody has completed cannot be approved — there is nothing to attest to.
Fieldwork and workpapers
Each workpaper carries the procedure, the testing performed, review notes and its own sign-off. Same rule as compliance: the preparer cannot approve their own workpaper.
Findings and remediation
Findings move through staged approval: draft observation → issued → management response → agreed → remediating → verified closed.
Actions under a finding are owned by the auditee, who updates their own progress. When the first action starts, the finding advances to remediating automatically. When every action is verified, the auditor is notified that it is ready to close.
Whoever owns a remediation action cannot be the one who verifies it, and the finding owner cannot verify-close their own finding. Independence is enforced, not assumed.