SmartSuite for the Internal Auditor
The Internal Auditor executes testing procedures, gathers evidence, documents findings and supports fieldwork. They validate that controls operate, log observations with root causes, link findings to risks and process owners, and verify that corrective actions are implemented.
What you own
The Internal Auditor executes testing procedures, gathers evidence, documents findings and supports fieldwork.
- Execute test procedures and gather evidence in fieldwork
- Document workpapers and address review notes
- Validate control execution and supporting evidence
- Log observations, root causes and severity assessments
- Link findings to related risks, controls and process owners
- Verify that corrective actions are implemented and effective
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
How SmartSuite supports this role
Lead
Internal audit. Manages workpapers with evidence attached, review notes and sign-offs, and links findings to related risks, controls and process owners.
Compliance management. Reviews control execution and supporting evidence with full testing history for SOX and compliance testing.
Issues and actions. Logs observations with root causes and routes findings for management response and remediation verification.
Reporting. Produces audit-ready summaries and findings from the testing records.
Products this role uses most
Industry reference
The IIA's Global Internal Audit Standards (2024) and the CIA body of knowledge define the work: sufficient, reliable evidence; documented workpapers; findings with criteria, condition, cause and effect; and follow-up of management actions. Independence and objectivity requirements apply to every engagement.
What is tested depends on sector: FFIEC-based control areas in banks, HIPAA and billing controls in healthcare, Yellow Book compliance audits in government, and IT general controls and SOC 2 criteria in technology. In each case the auditor's workpapers may be reviewed by regulators or external auditors placing reliance on them.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
What does an Internal Auditor do during an engagement?
The Internal Auditor executes the test procedures in the audit program, gathers sufficient, reliable evidence in fieldwork, documents workpapers and addresses review notes from the Audit Manager. They validate that controls operated and that the supporting evidence holds, log observations with root causes and severity, link findings to the risks, controls and process owners concerned, and later verify that management's corrective actions were implemented and effective. Independence and objectivity apply to every engagement.
How does SmartSuite help an Internal Auditor manage workpapers and review notes?
Internal Audit Management manages workpapers with evidence attached, review notes and sign-offs, and links findings to related risks, controls and process owners. Each test step carries its evidence, the Audit Manager's review notes sit against the workpaper they concern, and sign-off is recorded when they are cleared. Because findings link to the control and process owner, the auditor is not re-describing the control in every workpaper, and an external auditor placing reliance can follow the trail.
How does SmartSuite support SOX and compliance control testing?
SOX Compliance reviews control execution and supporting evidence with full testing history, so the Internal Auditor can see how a control tested in prior periods, what evidence was accepted and whether exceptions recurred before testing it again. Compliance Assessments & Testing covers the wider compliance testing on the same model. The Controls Testing Lead and Control Owner work from the same records, so the evidence request and the evidence supplied are in one place.
How are observations and corrective actions tracked after fieldwork?
Observations are logged with root causes in Issues Management and routed for management response and remediation verification, so a finding carries the criteria, condition, cause and effect, the owner's response and the evidence of remediation. The Internal Auditor verifies closure against that evidence rather than taking a status update on trust, and the follow-up the IIA's Global Internal Audit Standards require is a step in the record, not a separate project months later.
How does an Internal Auditor report findings to the Audit Manager?
SmartSuite produces audit-ready summaries and findings from the testing records, so the Internal Auditor's report to the Audit Manager is drawn from the workpapers, observations and management responses as they stand. The Compliance Analyst and Risk Analyst who worked alongside the engagement see the same findings linked to their risks and controls, and the summary that goes forward is traceable back to each test step and its evidence.
How quickly can an audit team start fieldwork in SmartSuite?
New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For an audit team the first workflow is one engagement: load the audit program for the next engagement with its test steps and the control owners who will supply evidence, then run that engagement in the system so review notes and sign-offs happen there. Prior findings can be loaded so follow-up verification has its history.
See SmartSuite for your role
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.