Internal Audit Function Sbp

Standard Operating Procedure: Internal Audit Function (IAF-SBP)

1. Document Control & Revision History

2. Executive Summary & Scope

The Internal Audit Function Standard Business Procedure (IAF-SBP) defines the enterprise framework for evaluating organizational efficacy, risk management, and internal control environments. This document governs all audit activities conducted within the organization, ensuring alignment with the International Standards for the Professional Practice of Internal Auditing (IIA).

Scope: Applies to all operational departments, financial reporting units, and information technology infrastructure. Regulatory Compliance: Sarbanes-Oxley Act (SOX), ISO 31000 (Risk Management), and GDPR/CCPA data handling mandates.

3. Prerequisites & Tool Requirements

• Access Credentials: Tier-1 Administrative access to GRC (Governance, Risk, and Compliance) platform (e.g., AuditBoard, MetricStream).
• Software/Systems: Read-only access to ERP (SAP/Oracle/NetSuite), Tableau/PowerBI for data extraction.
• Certifications: Lead auditor must hold active CPA, CIA, or CISA certification.
• PPE/Physical Security: Security badge clearance for physical data centers; biometric authorization for off-site storage access.

4. Roles & Responsibilities (RACI Matrix)

R=Responsible, A=Accountable, C=Consulted, I=Informed

5. Step-by-Step Operational Procedure

Phase I: Audit Planning & Scoping

• Review prior year audit findings and open remediation items.
• Conduct risk assessment interview with Department Heads.
• Finalize Audit Scope Statement and distribute to stakeholders.

Phase II: Fieldwork Execution

• Extract raw system data logs for the defined audit period.
• Perform substantive testing via random statistical sampling (Minimum 95% confidence interval).
• Validate evidence against pre-defined control matrices.

Phase III: Reporting & Closure

• Draft preliminary audit findings for management review.
• Conduct "Exit Interview" to confirm factual accuracy of observations.
• Submit Final Audit Report to the Audit Committee.

6. Quality Assurance & Verification Criteria

Audits are evaluated against the following benchmarks before archival:

• Evidence Sufficiency: 100% of findings must be supported by primary source documentation (e.g., timestamps, digital signatures, signed logs).
• Tolerance Thresholds: Zero tolerance for "Material Weakness" in financial reporting. Operational deficiencies (> $50k variance) require mandatory Corrective Action Plan (CAP).
• Benchmark: Must achieve a 90% "Satisfactory" rating from independent peer review every 24 months.

7. Practical Troubleshooting Scenarios

Scenario 1: Refusal of Access to Key Personnel

• Trigger: Departmental leadership denies access to proprietary logs claiming "Intellectual Property" protection.
• Protocol: Immediately suspend fieldwork. Escalate to the CAE to invoke the "Authority to Access" clause in the Audit Charter. Contact Legal/Compliance to confirm scope permissions.

Scenario 2: Data Integrity Mismatch

• Trigger: Discrepancy between ERP ledger values and source department sub-ledger reports exceeding 2% variance.
• Protocol: Halt testing. Perform a "Reconciliation Sprint." Document the variance as a high-risk finding. Notify the Controller immediately to assess for potential financial misstatement.

Scenario 3: Missing Audit Trail Evidence

• Trigger: Key system transaction logs purged prematurely by IT due to retention policy gaps.
• Protocol: Document as a "Control Design Deficiency." Utilize secondary testing methods (e.g., independent confirmation, recalculation) to gain reasonable assurance. Report as a significant finding regarding IT General Control (ITGC) maturity.