02 — Capability · BC-160
Internal Audit
Give the board independent, evidence-based assurance that risks are managed and controls work, by planning audits where the risk is, doing the fieldwork properly and following findings until they are actually fixed.
- Internal Audit Function
- Third Line
- Audit & Assurance
- Audit Services
In scope
- The audit universe, risk-based audit plan and audit charter
- Audit engagements from scoping through fieldwork, testing and reporting
- Findings, management actions and verification that they were completed
- Assurance over key controls and coordination with external auditors
Out of scope
- Designing risks and controls in the first place (see BC-130)
- Second-line compliance monitoring (see BC-140)
- The external financial statement audit itself (see BC-210)
Realized by · 1
- ServiceNow · Governance, Risk and Compliancepartial via BC-160.40
Used in · 1
- Record-to-Report · 06 Assure Controls via BC-160.40
Build it · 0
- Nothing in the library points here yet.
Decomposes into · 5
- BC-160.10Audit Planning & UniverseKnow everything that could be audited, rank it by risk and build the plan that spends limited audit hours where a failure would hurt most.
- BC-160.20Audit ExecutionCarry out each engagement to a consistent method — scope agreed, controls tested, evidence kept — so the conclusion can be defended to anyone who asks.
- BC-160.30Findings & Remediation TrackingTrack every audit finding to a management action with an owner and a date, verify the fix, and escalate what stays open — because a finding closed by the passage of time is not closed.
- BC-160.40Control AssuranceTest the key controls over financial reporting and critical operations on a cycle, and coordinate with external auditors so the same control is not tested three times by three people.
- BC-160.50Audit Quality & IndependenceKeep the function competent, independent and trusted — through a methodology, quality reviews, skills development and candid reporting to the audit committee.