How to conduct an internal audit

The words internal audit can stop you in your tracks. But conducting an internal audit is just like taking your car in for regular maintenance: It’s a great discipline to adopt for your small business to make sure everything is running smoothly, you have the correct procedures in place, and that your employees are doing their best work.

Types of audits

Internal audit: Examines issues related to a company’s business practices and risks and can be conducted throughout the year

External audit: Examines financial records and issues an opinion regarding the company’s financial statements

Most businesses will run an internal audit before they run an external audit.

Learn more about conducting an internal audit

An internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

While your small business might not have budget to outsource an audit or create an internal department, you can create your own system to internally audit your business. Tap into your existing team to get insights on your operations and financial controls. If you go this route, always involve at least two people so that employees can’t simply check their own compliance.

In fact, even just announcing an audit can help dissuade employees from committing fraud.

Small Biz Trends recommends discussing the audit results with your team to give everyone actionable information that can help your business grow.

What is the role of an internal audit?

Conducting regularly scheduled audits will help you identify and mitigate risks and ensure your business in in compliance with laws and regulations. You may also consider an audit in response to your evolving business. For example, an audit can be helpful before you request a loan or investment.

Preparing for an internal audit

Follow these steps to conduct an internal audit:

• Determine what you will audit. Bank accounts? Revenue? Processes? Conducting an internal audit is also an excellent opportunity to ensure you’re following any compliance, regulatory and legal items that might apply to your industry. It’s always best to find and correct any compliance issues before the government does.
• Determine when you will audit. Is this a regularly scheduled audit or one taking place based on an event? You can use the element of surprise and conduct audits on a yearly but irregular basis.
• Determine how you will audit those items outlined above. Do you need to form separate action groups for monitoring internal controls, improving operational practices and accounting? Do you need to interview suppliers, employees and customers? Validate cash flow? Examine credit lines extended to clients?
• Conduct the audit. Designate time and space for tasks like conducting the necessary interviews, visiting your bank, gathering invoices and bank statements, documenting new processes, and even changing passwords.
• Document findings and make necessary adjustments. Involve your team not only so they’re aware of procedural updates, but so they can also feel a sense of ownership and pride in the work they helped to achieve.

Types of audits

Audits look for potential fraud, which means a business owner will want to conduct audits on areas of the business where fraud could occur. Various audits could include revenue, bank accounts and purchase orders.

How to audit revenue:

According to Chron, the two main stages of a revenue audit include:

1. Testing the revenue accounts on your income statements
2. Examining your accounts receivable on the balance sheet

Chron explains that “auditors often use substantive procedures for revenue assessment to detect fraud or financial information misstatement” with the goal of determining “whether or not your account balances and transactions are valid, accurate and complete.”

This might include validating invoices or testing ending cash balances, for example. They could even contact your customers to confirm transactions.

During a revenue audit, potential issues such as financial statement manipulation, unauthorized expenditures or tax evasion may indicate fraud and misconduct. If this happens, the auditor may conduct what’s called unpredictable audit procedures to create uncertainty for employees or stakeholders, therefore making fraud easier to spot.

How to audit bank accounts:

Bad bookkeeping could land you in serious trouble. Follow these steps when auditing your bank account(s):

1. Find your last three bank statements.
2. Compare your transactions to the ones in your financial ledgers.
3. Mark down anything that sticks out to you.
4. Start investigating the discrepancies.

How to audit other accounts:

You’ll need to monitor your account managers to make sure that they aren’t embezzling from you. When auditing accounts, use basic accounting practices with the three major elements of accounting:

• Assets: Properties or rights owned by the business
• Liabilities: Economic obligations or payables of the business from borrowings from lenders or creditors, and contributions by the owners
• Capital: Basically, total assets minus total liabilities

Don’t worry, as long as you have a basic understanding or your own accounting system, you don’t need a finance degree to review your books. If you want to go deeper, you might have an accounting professional audit your books or financial process, specifying that you only want to check for illegal and fraudulent activity. This simpler review can save you money but still help make sure your financial information is accurate and up to par.

How to audit purchase orders:

Chron lays out these areas to look at when conducting a purchase order audit:

1. Set guidelines for approving purchase orders and shipments.
2. Create guidelines that ensure that only approved vendors are used for purchasing.
3. Have a process that checks the quality of the received merchandise.
4. Leave open dialog between your company, vendors to ensure accuracy and timeliness.

Auditing your inventory will allow you to catch lost items, stop employee theft and save money. Follow these steps to do a basic inventory audit:

1. Only count what you have, not what you're expecting.
2. Attach proper values to each counted item to get a total value.
3. Check past counts to see if certain items tend to be counted wrong.
4. Compare the physical count to what your ledgers say you have.
5. Investigate any discrepancies.

Employee audits

These allow you to verify an employee’s background, see the scope of their job, adjust compensation, assign trainings and conduct promotions and firings as needed.

Chron recommends that you follow these steps when completing an employee audit:

1. Review the employee personnel files to determine if they contain eligibility documentation, signed workplace policies, employee handbooks and emergency contact information.
2. Compare the employee's job description to the actual tasks the employee performs.
3. Review payroll records to determine whether employees are properly classified and if your payroll department is accurately processing any overtime pay.
4. Obtain copies of employee benefits package information.
5. Talk to supervisors about the department's staffing levels.
6. Examine training and orientation records to ensure employees receive up-to-date orientation and training on company policies, processes and structure.
7. Obtain workplace safety logs and records to determine whether employees follow safety procedures.

With each employee, you’ll want to maintain an employee audit form that documents all interactions and attendance to ensure a fake person (known as a “phantom employee”) isn’t on your payroll, and that employee paychecks haven’t changed without authorization.

Employee compliance audit

Also known as a human resources audit, this audit makes sure that your HR policies, procedures and practices meet federal and state laws that apply to employment.

Cybersecurity audit

No business is too small to experience cyber threats and attacks. Make sure your business follows cybersecurity best practices.Review these best practices during your audit to make sure you and your employees continue to follow best practices.

Get started

We know that’s a lot to take in, but audits are very important to the longevity of your business.

Consider these steps as you prepare for an internal audit

• Consider what risks you are trying to address (i.e. segregation of duties, fictitious revenue, employee theft, inventory management, etc.)
• Determine which area of the company or process you wish to audit
• Determine the scope of your audit and what your focus areas will be (i.e. examining certain documents, systems, conversations with employees, etc.)
• Hold an opening meeting with the department to discuss the planned approach
• Determine timeline and request any documentation ahead of time (i.e. financial reports such accounts receivable or accounts payable ledger or inventory listing)
• Select samples for testing and request supporting documentation to perform the audit

For more resources related to running a business, check out the Nationwide Small Business Solutions Center for more information.