Audit Manager
Operations
SmartSuite for the Audit Manager
The Audit Manager leads individual engagements: scoping, planning, oversight of fieldwork, review of workpapers and timely reporting. They define objectives, risks and controls with standard templates, track testing completion and sign-offs, and coordinate with process owners on findings.
Reports to:
What you own
The Audit Manager leads individual engagements: scoping, planning, oversight of fieldwork, review of workpapers and timely reporting.
- Scope and plan engagements with objectives, risks and controls
- Supervise fieldwork and review workpapers
- Manage engagement schedules, assignments and review notes
- Draft audit reports and agree findings with management
- Follow up management actions to closure
- Coach auditors and maintain engagement quality
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Audit Manager: navy is owned, blue is touched, grey is depended on.
- First lineThe business and its control ownersRun the processes, own the controls, fix the issues
- Second lineRisk, compliance and the domain programmesSet the frameworks, assess, monitor and advise
- Third lineInternal auditIndependent assurance to the board and audit committee
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Audit Director
See the roleDirect reports
Internal Auditor
See the roleAudit Analyst
See the roleWorks closely with
Control Owner
See the roleRisk Manager
See the roleCompliance Manager
See the roleAudit Quality Assurance Reviewer
See the roleHow SmartSuite supports the Audit Manager
Each engagement is yours from scoping to the final report, and the Audit Director, process owners and quality reviewers judge it by the workpapers. SmartSuite gives an Audit Manager planning templates for objectives, risks and controls, real-time sight of testing and sign-offs, and follow-up that keeps management actions moving to closure.
Plan, supervise and close each engagement
Define objectives, risks, controls and the work program from your methodology's templates, so each engagement starts with the structure the Audit Quality Assurance Reviewer will later check.
Audit Management suiteSee which procedures are tested, which are awaiting review and which have review notes outstanding, so supervision happens during fieldwork rather than in a rush before the report.
Audit Management suiteInternal Auditors attach evidence, notes and test details directly to each procedure, so every conclusion in the draft report traces back to the record that supports it.
Audit Management suiteWork with control owners, risk and compliance
Enterprise Risk Management (ERM) links the controls you test to the risks they mitigate, so observations are recorded against a specific risk the Risk Manager already owns.
Risk Management suiteRoute each finding to the Control Owner for review, capture their response and agreed action in the same record, and keep the discussion where the audit committee can later see it.
Audit Management suiteTask assignments, review reminders and follow-up requests to management are sent by automation, so your team's time goes to testing and coaching rather than status chasing.
Audit Management suiteReport to the Audit Director with confidence
Use the AI Assistant in a SmartDoc field to draft the report from recorded results, then edit against the evidence, so the report issues sooner and the Audit Director sees status without a separate update.
Audit Management suiteIssues Management holds every agreed action with its owner, due date and verification step, so you can show which actions closed on time and which needed escalation.
Audit Management suiteActivity history, approvals and version control are kept for each engagement, so examiners or external auditors relying on your work find a complete, reviewed file without reconstruction.
Audit Management suiteInternal audit. Defines objectives, risks and controls with standardized planning templates and tracks testing completion, review notes and sign-offs in real time.
Risk management. Reviews and tests controls linked to enterprise risks and records observations tied to specific risks.
Issues and actions. Automates task assignments, review reminders and follow-up requests to management.
Reporting. Produces engagement reports and status views from the workpapers.
Products this role uses most
Industry reference
The IIA's Global Internal Audit Standards (2024) set engagement requirements: objectives and scope tied to risk, a work program, supervised fieldwork, evidenced conclusions and findings agreed with management. Workpapers must support every conclusion and be reviewed before the report is issued.
Sector regimes shape the engagements. Bank audits are read by examiners under FFIEC and Basel expectations; healthcare audits cover billing, HIPAA and clinical compliance; government audits may need to meet GAO's Yellow Book; technology audits often test the ITGCs and SOC 2 controls that external assessors rely on.
Related roles
Audit Director
See the roleExplore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
The Audit Manager leads individual engagements from scoping to reporting: defining objectives, risks and controls, supervising fieldwork, reviewing workpapers, managing schedules, assignments and review notes, drafting the report and agreeing findings with management, then following management actions to closure. They also coach the auditors on the engagement and are accountable for its quality. In SmartSuite each engagement is a record in Internal Audit Management holding the plan, workpapers, review notes and findings together.
SmartSuite defines objectives, risks and controls with standardized planning templates in Internal Audit Management, so each engagement starts from the function's methodology rather than a blank document. During fieldwork the manager tracks testing completion, review notes and sign-offs in real time: which tests are done, which workpapers await review and which review notes the Internal Auditor has cleared. Nothing waits for a status meeting to be known.
The manager reviews and tests controls that are linked to enterprise risks in Enterprise Risk Management (ERM), and records observations tied to the specific risk each control addresses. That link means an observation is not just an exception in a workpaper; it shows which enterprise risk is less well controlled than assumed, which the Risk Manager and Control Owner can see on the same record when the finding is agreed.
SmartSuite automates task assignments, review reminders and follow-up requests to management, so the manager is not chasing by email. Findings agreed with management become actions in Issues Management with owners and dates; reminders go to the owner as dates approach, and the manager sees which actions have closed and which need escalation. The manager's time goes to reviewing workpapers and coaching rather than administration.
Engagement reports and status views are produced from the workpapers themselves, so the Audit Director sees fieldwork progress and emerging findings in SmartSuite as the engagement proceeds, not only at the draft report. The manager's report to management is drafted from the recorded findings, and the Audit Quality Assurance Reviewer can confirm review notes and sign-offs from the same record before issue. Compliance Managers see the findings relevant to their frameworks.
New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for an Audit Manager the first is one live engagement, set up once the function's planning templates are in place, and engagements already underway can be recorded at their current stage. The manager needs the engagement scope, the risks and controls in scope and the auditors assigned; workpapers and evidence are then captured as fieldwork happens. Because the Internal Auditor works in the same record, there is no separate transfer of workpapers for review.