Internal audit's value to a GRC program comes from one thing the other roles cannot provide: an objective opinion on whether controls are designed well and working as described. That opinion is only worth something if it is independent, if the testing behind it is documented well enough for someone else to re-perform, and if findings actually get fixed. This page covers each of those in practical terms.
Protecting independence in practice
Independence is partly structural and partly behavioral. Structurally, the audit function should have a reporting line to the board or an audit committee that is separate from the management it audits, so the CISO or compliance manager can be informed of results but cannot suppress them. Behaviorally, auditors should not design or operate the controls they later test. In small organizations where full separation is impossible, rotate auditors across areas, disclose any conflicts, or bring in an external party for the areas you helped build.
ISO 27001 reinforces this: clause 9.2 requires internal audits at planned intervals, with auditors selected to ensure objectivity and impartiality of the audit process. A certification auditor will look at who performed your internal audit and whether they were reviewing their own work.
Where professional standards fit
Many internal audit functions align to the Institute of Internal Auditors' Global Internal Audit Standards, which took effect in January 2025 and replaced the earlier International Standards for the Professional Practice of Internal Auditing. They are organized into five domains. The domain names are below; the detailed requirements sit in the standards themselves and are worth reading directly rather than second-hand.
Building a risk-based audit plan
- Pull the current risk register and control library, and list the auditable areas: access management, change management, vendor risk, incident response, and so on.
- Rate each area on inherent risk, time since last audit, prior findings, and significant change such as a migration or new framework.
- Check coverage across the cycle. Certification bodies generally expect the audit program to cover the whole ISMS over the certification cycle, not every area every year.
- Schedule so internal audit finishes well before external fieldwork, leaving time to remediate.
- Document the plan, get it approved by the audit committee or equivalent, and record any mid-year changes with the reason.
The free internal audit plan template gives a structure for the annual schedule, and pairs well with an audit evidence tracker for each engagement.
Working papers a reviewer can re-perform
- Objective, scope, period under review, and criteria being tested against
- Population source and how completeness of the population was verified
- Sample size and selection method, with the selected items listed
- Test steps performed and the result for each sample item
- The evidence itself, or a reference to where it is retained unaltered
- Exceptions noted, conclusion reached, preparer, reviewer, and dates
Rating findings and following them through
A finding is not closed when management says it is fixed. Follow a CAPA discipline: record the root cause, agree the corrective action and an owner, then retest after the action has had time to operate. Where management chooses to accept the risk instead, that decision should sit in the risk register with an accountable approver, not quietly in an email.
Tooling that supports the audit trail
Look for tooling that lets you scope an engagement directly from the live control library, attach unaltered evidence to test steps, and turn findings into tracked corrective actions without re-keying. Asurvo's Audit module runs internal and external audit workflows covering requests, evidence, findings, and remediation, with a dedicated auditor workspace.