Internal Audit Management in a Connected GRC Program

Internal audit is one of the few functions that can see across the organization.

Audit teams review risk, controls, compliance, cyber, privacy, third parties, SOX, finance, operations, resilience, AI governance, ESG, policies, evidence, and remediation.

That cross-functional view is valuable.

But internal audit often has to build that view manually.

The audit universe may live in one place.
The enterprise risk register may live somewhere else.
Control libraries may be maintained by compliance.
SOX controls may sit with finance.
Cyber risk may sit with security.
Vendor risk may sit with procurement or third-party risk.
Evidence may be stored in folders.
Findings may be tracked in an audit tool.
Management action plans may be updated in spreadsheets.
Issues may be tracked separately by compliance, risk, cyber, privacy, and SOX teams.
Audit committee reporting may be assembled manually.

Internal audit can still complete the work.

But the process is harder than it needs to be.

Audit planning becomes less dynamic. Evidence collection becomes repetitive. Findings are harder to connect to risks and controls. Remediation follow-up becomes manual. Repeat issues are harder to detect. Audit committee reporting can show status without showing the full risk story.

In a Connected GRC program, internal audit management is not a separate audit silo.

It is a connected assurance workflow that links the audit universe, audit plans, engagements, risks, controls, evidence, findings, issues, management action plans, remediation, validation, and reporting.

The goal is not to compromise audit independence.

The goal is to give internal audit better context, stronger evidence, clearer remediation visibility, and a more useful assurance story.

What is internal audit management in Connected GRC?

Internal audit management in a Connected GRC program is the process of planning, executing, reporting, tracking, and validating internal audit work through connected risks, controls, evidence, findings, issues, remediation plans, and assurance reporting.

It includes:

• audit universe management
• risk-based audit planning
• engagement planning
• audit fieldwork
• workpaper management
• evidence review
• control testing
• audit findings
• root cause analysis
• management action plans
• issue remediation
• closure validation
• audit committee reporting
• connected assurance
• audit follow-up
• audit analytics and dashboards

A disconnected audit process can show that audits were completed.

A connected internal audit process can show what audits revealed about the organization’s risk and control environment.

That is the difference.

Why internal audit needs Connected GRC

Internal audit work depends on context.

An audit finding is more useful when it connects to the risk it affects.
A risk is more useful when it connects to controls.
A control is more useful when it connects to evidence.
Evidence is more useful when it connects to testing.
Testing is more useful when it connects to issues.
Issues are more useful when they connect to remediation.
Remediation is more useful when closure is validated.
Reporting is more useful when it shows patterns.

Without those connections, internal audit can still produce findings.

But the organization may miss the broader message.

For example, five audit findings may look separate at first:

• incomplete access review
• missing vendor evidence
• weak policy attestation
• delayed incident escalation
• incomplete business continuity testing

But when connected to risks, controls, owners, and issues, those findings may reveal one root cause: unclear control ownership.

That is the value of Connected GRC.

It helps internal audit move from isolated findings to connected assurance.

Internal audit management in the Connected GRC map

Internal audit touches many GRC records.

This map matters because internal audit should not be forced to reconstruct the GRC story engagement by engagement.

The connected records should already exist.

Audit can then focus more time on assurance, analysis, root cause, and management challenge.

1. Connect the audit universe to enterprise risk

The audit universe should not be a static inventory of departments.

It should reflect where assurance may be needed.

A connected audit universe should include:

• enterprise risks
• business objectives
• business units
• key processes
• systems and applications
• critical services
• legal entities
• regulatory obligations
• third parties
• prior audit findings
• open issues
• incidents
• control failures
• SOX scope
• cyber risks
• privacy risks
• AI governance areas
• ESG reporting areas
• operational resilience dependencies

This is where Internal Audit Management should connect to Enterprise Risk Management.

Internal audit does not need to accept the enterprise risk register without challenge.

But the audit universe should understand it.

If an enterprise risk is high and growing, audit should know whether assurance coverage exists. If a risk is outside appetite, audit should know whether controls have been tested. If a risk has repeated issues, audit should consider whether the area belongs in the audit plan.

A connected audit universe helps the Chief Audit Executive answer:

• What could we audit?
• Why would we audit it?
• Which risks does it relate to?
• What assurance coverage already exists?
• Where are the gaps?

That is a stronger foundation than last year’s audit plan plus interviews.

2. Connect audit planning to live risk signals

Risk-based audit planning is not only an annual exercise.

The annual plan matters, but risks change throughout the year.

A Connected GRC approach helps audit planning use live signals, including:

• new or changing enterprise risks
• RCSA results
• control failures
• overdue issues
• repeated incidents
• cyber vulnerabilities
• vendor incidents
• regulatory changes
• privacy concerns
• AI governance gaps
• SOX deficiencies
• ESG evidence gaps
• business continuity test failures
• management concerns
• audit committee priorities

This is where Risk and Control Self-Assessment, Issues Management, Compliance Assessments & Testing, Incident Management, and Regulatory Change Management become important inputs.

Deloitte’s internal audit hot topics work points to a broad and evolving audit agenda, including GenAI, fraud risk, and cybersecurity.  A connected audit planning process helps the audit function adapt when those emerging areas become material to the organization.

Audit planning should not chase every signal.

But it should be informed by them.

Connected GRC gives internal audit a better way to decide when the plan should change.

3. Connect audit engagements to risks and controls

Every audit engagement should preserve the logic of the audit.

That means connecting:

• why the audit was selected
• which risks are in scope
• which controls are being evaluated
• which obligations or policies are relevant
• which evidence was reviewed
• which findings were identified
• which management actions were agreed
• which issues were opened
• which remediation must be validated

A Connected GRC approach links audit engagements to Control Framework & Regulatory Libraries, Enterprise Risk Management, and Compliance Assessments & Testing.

This helps answer:

• Which risk does the engagement address?
• Which controls are in scope?
• Were controls already tested by compliance, SOX, or another assurance team?
• Which evidence already exists?
• Which issues are already open?
• Which findings are new?
• Which findings confirm existing concerns?

This does not mean internal audit gives up independent judgment.

It means internal audit starts from better context.

Audit can still reperform, challenge, expand, or independently test as needed.

But the engagement should not begin with a blank page if connected GRC data already exists.

4. Connect workpapers to evidence and conclusions

Workpapers are the record of audit work.

They should show what was tested, what evidence was reviewed, what conclusion was reached, and why.

A connected workpaper should include:

• engagement objective
• risk tested
• control tested
• test procedure
• evidence reviewed
• evidence source
• period covered
• preparer
• reviewer
• conclusion
• exceptions
• finding, if applicable
• issue link
• remediation link

The IIA’s Global Internal Audit Standards include expectations around engagement results, findings, recommendations or action plans, owners, and timing, which reinforces the need for clear documentation and traceability throughout the engagement lifecycle.  

A Connected GRC approach helps workpapers become more than static files.

Evidence can link directly to controls, issues, prior tests, and remediation history.

That makes workpaper review easier.

It also makes future audits stronger because prior evidence and conclusions remain connected to the control environment.

5. Connect audit evidence to existing control evidence

Internal audit often requests evidence that other teams have already collected.

Sometimes audit must collect its own evidence. That is appropriate.

But audit should still know whether related evidence already exists.

For example:

• compliance may have tested the control
• SOX may have collected evidence
• SOC 2 may have reviewed the same process
• cyber may have incident records
• privacy may have assessment evidence
• third-party risk may have vendor evidence
• business continuity may have exercise evidence
• ESG may have disclosure evidence

A Connected GRC model lets internal audit see existing evidence while preserving independence.

Audit can decide whether to:

• rely on it
• reperform it
• sample from it
• compare it
• challenge it
• request additional support
• perform independent testing

This reduces business fatigue.

It also helps audit spend more time on higher-value review instead of evidence hunting.

6. Connect audit findings to risk

A finding should not sit alone.

It should connect to the risk it affects.

A finding may relate to:

• enterprise risk
• operational risk
• compliance risk
• cyber risk
• privacy risk
• third-party risk
• financial reporting risk
• AI risk
• ESG reporting risk
• resilience risk
• legal or regulatory risk

A Connected GRC approach links Internal Audit Management to Enterprise Risk Management.

That helps answer:

• Which risk does this finding affect?
• Does the finding change residual risk?
• Does the finding show that controls are weaker than expected?
• Does the finding relate to a risk outside appetite?
• Does the finding require executive escalation?
• Should the audit plan change based on the finding?
• Are similar findings affecting the same risk elsewhere?

A finding is more useful when it changes the risk conversation.

If audit identifies a significant control weakness tied to a top enterprise risk, the ERM view should not ignore it.

Connected GRC keeps audit findings and risk reporting aligned.

7. Connect audit findings to controls

Many audit findings are control findings.

They may involve:

• control not performed
• control performed late
• evidence missing
• evidence incomplete
• review not precise enough
• policy not followed
• procedure outdated
• owner unclear
• vendor evidence missing
• system report unreliable
• access review incomplete
• incident response not documented
• remediation not validated

A Connected GRC approach links audit findings to Control Framework & Regulatory Libraries.

That helps answer:

• Which control failed?
• Is the control design weak?
• Is the operating effectiveness weak?
• Is the control still needed?
• Does the control support multiple frameworks?
• Which obligations are affected?
• Has the control failed before?
• Which issue or remediation plan is open?

This matters because control findings should update control history.

A finding should not only appear in the audit report.

It should become part of the control record.

That is how the organization learns over time.

8. Connect findings to root cause

A finding without root cause is incomplete.

Root cause helps the organization fix the actual problem.

Common root causes include:

• unclear ownership
• poor training
• outdated procedure
• missing automation
• incomplete data
• weak system design
• poor evidence retention
• insufficient review precision
• inadequate vendor oversight
• unclear policy language
• control not aligned to current process
• poor change management
• resource constraints
• lack of monitoring
• management override
• weak escalation

A Connected GRC approach should allow findings to be grouped by root cause.

That helps internal audit identify patterns.

For example:

• repeated access issues across business units
• repeated vendor oversight gaps
• repeated policy exceptions
• repeated evidence quality failures
• repeated remediation delays
• repeated control owner confusion

Those patterns are often more valuable than the individual findings.

Audit reporting becomes more useful when it shows management where systemic improvement is needed.

9. Connect findings to management action plans

Management action plans are where audit findings become business commitments.

A weak action plan says:

Management will review and improve the process.

A stronger action plan says:

Management will update the access review procedure, define report parameters, assign control ownership, train control performers, complete two operating cycles, and submit evidence for audit validation by September 30.

A connected management action plan should include:

• finding
• root cause
• management response
• remediation owner
• business owner
• due date
• milestones
• evidence required
• validation method
• escalation path
• status
• closure decision

This is where Issues Management becomes critical.

SmartSuite’s Audit Management page describes unifying audit planning, fieldwork, findings, and remediation in a connected workspace that links audit activities to risks, controls, and corrective actions.  

Audit findings should become structured remediation records.

Otherwise, follow-up becomes manual and inconsistent.

10. Connect management action plans to issue management

Audit findings often create issues.

But the organization may already have issues from compliance testing, SOX, cyber, privacy, third-party risk, incidents, regulatory inquiries, or business continuity testing.

A Connected GRC model uses Issues Management as the common workflow for remediation.

This helps answer:

• Which audit findings are open?
• Which findings are overdue?
• Which findings relate to existing issues?
• Which issues have the same root cause?
• Which owners have multiple overdue actions?
• Which findings affect top risks?
• Which findings require executive escalation?
• Which findings have been validated as closed?

This prevents audit remediation from becoming separate from enterprise remediation.

A finding is not just an audit item.

It is a risk and control issue that needs accountable closure.

11. Connect remediation to validation

Internal audit should not close findings only because management says they are complete.

Closure should be validated.

Validation may include:

• reviewing remediation evidence
• retesting the control
• reviewing updated policy or procedure
• confirming system changes
• verifying owner training
• reviewing evidence from a new operating period
• validating issue closure
• confirming compensating controls
• reviewing management certification
• confirming audit committee expectations were met

A connected validation record should include:

• management action plan
• evidence submitted
• validation owner
• validation method
• validation result
• date validated
• remaining exceptions
• closure decision
• follow-up required

This is one of the most important parts of audit credibility.

A finding should not be closed administratively when the underlying weakness remains.

Connected GRC gives internal audit a clear way to track closure evidence and validation status.

12. Connect audit to SOX and financial controls

SOX and internal audit often intersect.

Internal audit may help test SOX controls, review financial reporting risks, evaluate remediation, or assess the broader control environment.

A Connected GRC approach links Internal Audit Management to SOX Management, SOX Compliance, Control Framework & Regulatory Libraries, and Compliance Assessments & Testing.

This helps answer:

• Which SOX controls have audit findings?
• Which deficiencies are open?
• Which ITGCs are weak?
• Which financial reporting risks are affected?
• Which remediation plans need validation?
• Which findings should be reported to the audit committee?
• Which evidence has already been reviewed?

SOX findings should not sit separately from audit findings.

They should connect to the broader assurance picture where relevant.

That gives audit committees a clearer view of control health.

13. Connect audit to compliance and regulatory change

Internal audit often reviews compliance programs, regulatory change management, policy management, testing, and regulatory inquiries.

A Connected GRC approach links audit to:

• Regulatory Change Management
• Regulatory Inquiries
• Policy Management
• Compliance Assessments & Testing
• Control Framework & Regulatory Libraries
• Issues Management

This helps audit teams evaluate:

• whether regulatory changes are identified
• whether applicability decisions are documented
• whether obligations are mapped
• whether policies and controls are updated
• whether evidence proves implementation
• whether inquiries are managed consistently
• whether issues are remediated

Regulatory and compliance failures often come from process breakdowns.

Internal audit can provide assurance over whether the compliance operating model is working.

Connected GRC gives audit the evidence trail needed to test that model.

14. Connect audit to cyber and IT risk

Cyber and IT risk are now regular internal audit topics.

Audit may review:

• cyber governance
• access management
• vulnerability management
• incident response
• cloud controls
• change management
• system availability
• backup and recovery
• logging and monitoring
• vendor security
• data governance
• AI system controls
• technology resilience

Deloitte’s internal audit hot topics include cybersecurity and GenAI among areas shaping internal audit’s role, which reinforces the need for audit teams to connect technology risk to assurance planning.  

A Connected GRC approach links audit to Cyber & IT Risk, Cyber Threat Management, Vulnerability Management (GRC), Incident Management, and Enterprise Assets & Structure.

This helps answer:

• Which cyber risks are material?
• Which systems are critical?
• Which vulnerabilities are overdue?
• Which incidents revealed control failures?
• Which cyber controls have evidence?
• Which issues remain open?
• Which risks require audit coverage?

Internal audit does not need to become security operations.

But it does need connected visibility into cyber risk and control evidence.

15. Connect audit to third-party risk

Third-party risk is a natural audit focus because vendors can affect cyber, privacy, resilience, compliance, legal, financial, ESG, and operational risk.

A Connected GRC approach links audit to Third Party Risk Management, Third Party Risk, Vendor Portal, and Contract Lifecycle Management.

Audit may review:

• vendor inventory completeness
• risk tiering
• due diligence
• contract controls
• cyber reviews
• privacy reviews
• ongoing monitoring
• issue remediation
• vendor incidents
• critical supplier oversight
• renewal governance
• offboarding

Connected third-party records help audit answer:

• Which vendors are critical?
• Which vendors have open issues?
• Which contracts lack required terms?
• Which vendors process sensitive data?
• Which vendors support critical services?
• Which vendor incidents occurred?
• Which evidence supports vendor oversight?

Vendor audit findings become more useful when they connect to the vendor record, risk rating, contract, issue, and renewal decision.

16. Connect audit to privacy, AI governance, ESG, and resilience

Internal audit is increasingly asked to provide assurance over newer or expanding risk areas.

Privacy

Audit may review data inventories, DPIAs, DSARs, privacy incidents, vendor privacy reviews, retention controls, and privacy evidence.

Relevant links:

• Privacy Management
• Privacy Risk Management
• Incident Management
• Third Party Risk

AI governance

Audit may review AI inventory, policy compliance, approvals, risk assessments, privacy and security reviews, vendor involvement, monitoring, and issues.

Relevant links:

• AI Governance
• CRI AI RMF
• Policy Management
• Issues Management

ESG

Audit may review ESG metrics, source data, evidence, controls, supplier inputs, disclosure approvals, and assurance readiness.

Relevant links:

• ESG Management
• ESG & Sustainability Management
• Compliance Assessments & Testing
• Control Framework & Regulatory Libraries

Operational resilience

Audit may review BIAs, continuity plans, critical services, incident response, crisis management, scenario testing, vendor resilience, and remediation.

Relevant links:

• Operational Resilience & Business Continuity
• Business Impact Analysis
• Operational Resilience
• Crisis Management

These domains should not create separate audit evidence silos.

Connected GRC helps internal audit evaluate them through the same pattern: risks, controls, evidence, issues, remediation, and validation.

17. Connect internal audit reporting to themes

Audit reporting should not only list findings.

It should help leaders understand themes.

Useful themes may include:

• unclear control ownership
• weak evidence discipline
• poor vendor oversight
• recurring access issues
• repeated policy exceptions
• slow remediation
• weak root-cause analysis
• incomplete regulatory change implementation
• poor data quality
• inconsistent issue validation
• weak business continuity testing
• cyber control gaps
• privacy assessment delays
• ESG evidence weaknesses
• AI governance gaps

A connected audit reporting model helps show:

• findings by risk
• findings by control family
• findings by root cause
• findings by business unit
• findings by owner
• findings by age
• findings by severity
• findings by recurrence
• findings tied to top risks
• findings tied to audit committee priorities

This is where internal audit can create more value.

A finding tells management what went wrong.

A theme tells management what pattern needs attention.

18. Build internal audit dashboards that show assurance, not just activity

Internal audit dashboards often show activity:

• audits planned
• audits completed
• reports issued
• findings opened
• findings closed

Those metrics matter.

But a connected audit dashboard should also show assurance quality, risk alignment, and remediation health.

Useful dashboard views include:

The dashboard should answer:

• Are we auditing the right risks?
• What are we learning?
• What remains unresolved?
• Which owners are late?
• Which findings are repeating?
• Which risks lack assurance coverage?
• What needs leadership attention?

That is internal audit reporting in Connected GRC.

How Connected GRC changes the internal audit conversation

A disconnected internal audit conversation sounds like this:

“The audit plan is on track. We issued several reports, opened findings, and are following up on management action plans.”

A connected internal audit conversation sounds like this:

“Three findings from two audits relate to the same root cause: unclear control ownership. Two findings affect top enterprise risks. One management action plan is overdue and also affects SOX readiness. Internal audit has validated closure for four issues, but two remain open because remediation evidence is incomplete. We recommend adjusting the audit plan to assess the same control family in adjacent business units.”

The second conversation is more useful.

It connects audit plan status, findings, root cause, enterprise risk, SOX, remediation evidence, validation, and future audit planning.

That is what internal audit management should do in Connected GRC.

Where to start improving internal audit management

Organizations do not need to rebuild the full audit function at once.

Start where disconnection creates the most friction.

Start with the audit universe if planning feels static

Connect auditable entities to enterprise risks, controls, issues, incidents, vendors, systems, critical services, and prior findings.

Relevant links:

• Internal Audit Management
• Enterprise Risk Management
• Risk and Control Self-Assessment
• Issues Management

Start with findings if follow-up is manual

Create a structured workflow for findings, root cause, management action plans, due dates, evidence, validation, and escalation.

Relevant links:

• Issues Management
• Internal Audit Management
• Control Framework & Regulatory Libraries
• Enterprise Risk Management

Start with evidence if audits create business fatigue

Connect workpapers to existing evidence, control tests, compliance assessments, SOX evidence, and issue records.

Relevant links:

• Compliance Assessments & Testing
• Control Framework & Regulatory Libraries
• SOX Compliance
• SOC 2 Compliance

Start with risk alignment if audit coverage is hard to explain

Map audit engagements to enterprise risks, top controls, regulatory obligations, and audit committee priorities.

Relevant links:

• Enterprise Risk Management
• Risk and Control Self-Assessment
• Regulatory Change Management
• Compliance Management

Start with remediation validation if findings close too easily

Require evidence, retesting, or independent validation before closing material audit findings.

Relevant links:

• Issues Management
• Internal Audit Management
• Compliance Assessments & Testing
• Enterprise Risk Management

Start with audit committee reporting if status is too manual

Build dashboards from source data across audit plan coverage, findings, root causes, overdue actions, validation, and risk themes.

Relevant links:

• Internal Audit Management
• Enterprise Risk Management
• Issues Management
• SOX Management

The best starting point is the one that helps internal audit move from status tracking to connected assurance.

Common internal audit management mistakes to avoid

Mistake 1: Treating the audit universe as a static list

The audit universe should reflect changes in risk, controls, systems, vendors, regulations, incidents, and business priorities.

Mistake 2: Planning audits without connected risk data

Interviews are useful, but audit planning should also consider issues, incidents, control failures, regulatory change, vendor exposure, and audit findings.

Mistake 3: Requesting evidence without checking what already exists

Internal audit may need independent evidence, but it should know whether related evidence has already been collected by compliance, SOX, cyber, privacy, or third-party risk teams.

Mistake 4: Reporting findings without root cause

Findings are more useful when they show why the issue happened and whether similar patterns exist elsewhere.

Mistake 5: Tracking management action plans outside issue management

Audit remediation should connect to the organization’s broader issue-management workflow.

Mistake 6: Closing findings without validation

Management status updates are not enough for material findings.

Closure should require evidence and, where appropriate, retesting.

Mistake 7: Reporting activity instead of assurance value

Completed audits are useful, but audit committees also need to understand risk coverage, findings, themes, overdue remediation, and assurance gaps.

A practical test for your internal audit process

Pick one completed audit finding.

Then ask whether your current GRC model can quickly show:

• the audit engagement
• the audit objective
• the risk involved
• the control involved
• the evidence reviewed
• the test procedure
• the finding severity
• the root cause
• the business owner
• the management response
• the management action plan
• the remediation owner
• the due date
• the evidence required for closure
• the validation method
• the closure decision
• related issues
• related audit findings
• related enterprise risk
• related SOX, cyber, privacy, vendor, AI, ESG, or resilience impact
• audit committee relevance

If answering those questions requires workpapers, emails, spreadsheets, issue logs, control matrices, evidence folders, audit reports, and meetings, the internal audit process is not connected enough.

That is common.

It is also the opportunity.

Final thought

Internal audit management should not be disconnected from the rest of GRC.

Audit planning should connect to risk.
Engagements should connect to controls.
Workpapers should connect to evidence.
Findings should connect to root cause.
Root cause should connect to issues.
Issues should connect to management action plans.
Action plans should connect to evidence.
Evidence should connect to validation.
Validation should connect to assurance reporting.

Connected GRC gives internal audit that structure.

It helps audit teams plan with better risk intelligence.

It helps auditors reduce duplicate evidence requests.

It helps findings become actionable remediation.

It helps management understand ownership.

It helps audit committees see themes instead of isolated findings.

It helps the organization learn from assurance work.

That is the practical value of Internal Audit Management in a Connected GRC program.

It turns audit work into connected assurance.