Internal Audit Checklist

A phase-by-phase checklist covering audit planning, internal controls review, fieldwork testing, and final reporting. Assign auditors, track findings, and manage remediation in one place.

Free download Excel, Word & PDF 28+ audit tasks
MK
JD
SL
+
Used by 1,800+ audit teams
Internal Audit Checklist
Audit Planning (Week 1)
Define audit scope and objectives
Identify key risk areas
Controls Review (Week 2)
Evaluate segregation of duties
Test access controls in ERP
Fieldwork (Week 3)
Sample and test revenue transactions
Verify bank reconciliation accuracy
Reporting (Week 4)
Classify findings by severity
Draft audit report
38% Complete — 3 of 8 tasks done

Build your internal audit checklist

Check off tasks, assign auditors, and set due dates. The live preview updates as you work through each phase.

1

Audit Planning (Week 1)

Define audit scope and objectives
Identify key risk areas and prioritize
Assign audit team roles and responsibilities
Request and review prior audit reports
Prepare document request list (PBC)
Set fieldwork schedule and milestones
Notify departments and schedule walkthroughs
2

Internal Controls Review (Week 2)

Evaluate segregation of duties across finance
Review approval workflows for journal entries
Test user access controls in ERP system
Verify reconciliation completeness and timeliness
Confirm change management procedures are followed
Assess data backup and retention policies
Document control gaps and preliminary findings
3

Fieldwork & Testing (Week 3)

Sample and test revenue recognition transactions
Verify bank reconciliation accuracy and aging
Review AP aging and vendor payment compliance
Test payroll calculations and deductions
Examine intercompany transactions and eliminations
Validate fixed asset depreciation schedules
Review expense report policy compliance
4

Reporting & Remediation (Week 4)

Compile and organize audit findings
Classify findings by severity (High/Medium/Low)
Draft internal audit report with recommendations
Present findings to management and audit committee
Create remediation action plan with deadlines
Assign remediation owners for each finding
Schedule follow-up audit for open items
Archive workpapers and supporting documentation
Live preview
Internal Audit Checklist
Audit Period:
0
Done
29
Pending
29
Total

Set up your audit checklist in five steps

1

Define scope

Set the audit boundaries: which departments, accounts, and processes are in scope for this engagement.

2

Assign auditors

Assign a lead auditor, staff auditors, and identify the process owners who will provide evidence and walkthroughs.

3

Set milestones

Pin each phase to a week within your audit window. Front-load planning so fieldwork starts on time.

4

Test & document

Work through each task, attach workpapers, and flag findings as you go. The progress bar tracks completion.

5

Report & remediate

Compile findings into the audit report, assign remediation owners, and schedule follow-up testing.

Download a ready-to-use audit checklist

Excel (.xlsx)

Pre-built with severity dropdowns, owner assignments, finding status tracking, and auto-calculated progress.

Word (.docx)

Print-friendly audit workpaper layout with checkboxes, signature lines, and observation notes per task.

PDF

Locked format for audit archives. All 28+ tasks grouped by phase with severity and status columns.

A 4-week audit cycle, mapped out

A typical internal financial audit runs over four weeks. Here is how the checklist phases map to each week.

W1
Planning
  • Define scope
  • Risk assessment
  • PBC list
  • Schedule walkthroughs
W2
Controls Review
  • Segregation of duties
  • Access controls
  • Reconciliation checks
  • Document gaps
W3
Fieldwork
  • Transaction testing
  • Bank recon review
  • AP/AR aging
  • Intercompany testing
W4
Reporting
  • Compile findings
  • Draft report
  • Remediation plan
  • Archive workpapers
PlanningControlsFieldworkReporting

Make your audits audit-ready

Bluecopa automates reconciliations, enforces segregation of duties, and gives auditors a complete trail from day one.

Get a Demo →

How internal audits work

An internal audit is an independent review of an organization's financial processes, controls, and compliance. The goal is to identify control weaknesses, assess risk exposure, and recommend improvements before external auditors or regulators arrive.

1 Plan & scope

Define which business areas, processes, and accounts are in scope. Conduct a risk assessment to focus testing on the highest-risk controls. Request prior audit reports and open remediation items.

2 Evaluate controls

Walk through each process with its owner. Document how controls are designed (e.g., approval workflows, access restrictions, reconciliation procedures) and whether they match documented policies.

3 Test & sample

Select transaction samples and test whether controls operated as designed. Verify reconciliation accuracy, check journal entry authorization, and look for exceptions like aged reconciling items or policy violations.

4 Report & remediate

Classify each finding by severity (material weakness, significant deficiency, or observation). Draft the audit report, present to management, assign remediation owners, and schedule follow-up testing.

Do this, avoid that

✓ Do this

  • ✓ Start with a risk assessment to focus testing on the highest-exposure areas
  • ✓ Conduct walkthroughs with process owners before diving into transaction testing
  • ✓ Test controls over the entire audit period, not just at a point in time
  • ✓ Document every finding with root cause, impact, and a recommended fix
  • ✓ Use standardized severity ratings so management can prioritize remediation
  • ✓ Archive workpapers in a central location accessible to external auditors

✕ Avoid that

  • ✕ Auditing every process equally instead of risk-prioritizing
  • ✕ Skipping the planning phase and jumping straight into testing
  • ✕ Relying on management's word without testing the actual evidence
  • ✕ Issuing the audit report without giving process owners a chance to respond
  • ✕ Leaving findings open without assigned owners and deadlines
  • ✕ Treating internal audit as a once-a-year exercise instead of continuous monitoring

Internal audit terms, explained

Material Weakness

A deficiency in internal controls severe enough that there is a reasonable possibility of a material misstatement in the financial statements not being prevented or detected on time.

Significant Deficiency

A control deficiency, or combination of deficiencies, important enough to merit attention from those responsible for oversight of financial reporting. Less severe than a material weakness.

Walkthrough

A procedure where the auditor traces a single transaction through each step of the process, from initiation to recording, to understand how a control is designed and whether it is implemented.

Substantive Testing

Audit procedures designed to detect material misstatements at the assertion level. Includes tests of details (transaction sampling) and substantive analytical procedures (variance analysis).

Segregation of Duties

A control principle that separates authorization, custody, and record-keeping among different people to prevent fraud and errors. For example, the person approving a payment should not be the one initiating it.

PBC List

Prepared by Client list. A document request sent to the auditee before fieldwork begins, listing every piece of evidence the audit team needs: reconciliations, policies, reports, and supporting schedules.

Frequently asked questions

An internal audit is conducted by the organization's own team (or an outsourced firm reporting to management) to improve processes and controls. An external audit is performed by an independent firm to issue an opinion on the financial statements for shareholders and regulators. Internal audits are advisory; external audits are attestation.
Most organizations run internal audits on a rolling annual plan, covering each high-risk area at least once per year. High-risk processes like revenue recognition, cash management, and procurement may be audited quarterly. The frequency depends on the organization's risk profile, regulatory requirements, and audit committee expectations.
A complete audit report includes the audit scope and objectives, methodology, a summary of findings classified by severity, root cause analysis for each finding, management's response, agreed remediation actions with owners and deadlines, and a follow-up timeline. The report should be clear enough for someone outside the audit team to understand the risk.
Start with a risk assessment that considers financial impact, transaction volume, complexity, prior audit findings, and regulatory exposure. Areas with high inherent risk and weaker controls get priority. The audit committee typically approves the annual audit plan based on this risk ranking.
COSO (Committee of Sponsoring Organizations) provides the most widely used framework for designing and evaluating internal controls. Its five components, control environment, risk assessment, control activities, information and communication, and monitoring, are what auditors assess when testing whether controls are designed and operating effectively.
Dedicated audit and close management software (like Bluecopa, AuditBoard, or Diligent) replaces spreadsheet-based checklists with automated task assignment, real-time status tracking, and built-in evidence collection. The biggest advantage is continuous monitoring: instead of testing controls once a year, the software flags exceptions in real time so issues get resolved before the audit even starts.

Related checklists

SOX Compliance Checklist

Section 302 and 404 requirements mapped to controls testing and certification tasks.

Month-End Close Checklist

Pre-close, core close, and post-close tasks for a 5-day financial close cycle.

Audit Preparation Checklist

PBC list, document requests, and walkthrough schedules for external audit readiness.

Bank Reconciliation Checklist

Step-by-step tasks for matching bank statements to GL cash accounts.

Browse all reconciliation checklists

Internal Audit Checklist Month-End Close Checklist Year-End Close Checklist SOX Compliance Checklist Bank Reconciliation Checklist Audit Preparation Checklist Intercompany Reconciliation Checklist
View all checklists →