Internal Auditor
SmartSuite for the Internal Auditor
The Internal Auditor executes testing procedures, gathers evidence, documents findings and supports fieldwork. They validate that controls operate, log observations with root causes, link findings to risks and process owners, and verify that corrective actions are implemented.
Reports to:
What you own
The Internal Auditor executes testing procedures, gathers evidence, documents findings and supports fieldwork.
- Execute test procedures and gather evidence in fieldwork
- Document workpapers and address review notes
- Validate control execution and supporting evidence
- Log observations, root causes and severity assessments
- Link findings to related risks, controls and process owners
- Verify that corrective actions are implemented and effective
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Internal Auditor: navy is owned, blue is touched, grey is depended on.
- First lineThe business and its control ownersRun the processes, own the controls, fix the issues
- Second lineRisk, compliance and the domain programmesSet the frameworks, assess, monitor and advise
- Third lineInternal auditIndependent assurance to the board and audit committee
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Audit Manager
See the roleDirect reports
Works closely with
Control Owner
See the roleCompliance Analyst
See the roleRisk Analyst
See the roleControls Testing Lead
See the roleHow SmartSuite supports the Internal Auditor
The Internal Auditor produces the workpapers, evidence and findings that the Audit Manager reviews and that external auditors and regulators may place reliance on. SmartSuite gives fieldwork a structured home, so every test step has its evidence attached, every observation its root cause and owner, and every corrective action a verification trail.
Execute fieldwork with evidence in the record
Workflow-driven evidence requests go to the Control Owner with automated reminders and validation, so you spend fieldwork testing what arrived rather than emailing for what has not.
Audit Management suitePerform each test procedure directly in SmartSuite with structured steps, results and automated status updates, so the Audit Manager sees progress without a status email and the workpaper is the record of the test.
Audit Management suiteLog each observation with its root cause and severity assessment and route it to the process owner for response, so the finding the Audit Manager reviews already carries the cause and the rating rather than being reworked at review.
Audit Management suiteStay connected to control owners, risk and compliance
Test IT general controls and business controls in the same connected SOX workflow, with consistent procedures and scoring across cycles, so your work and the Controls Testing Lead's line up at year end.
SOX Management suiteEach finding connects to the related risk, control, KRI and process owner, so the Risk Analyst and Compliance Analyst see your finding in their context and the Control Owner knows exactly which control failed.
Audit Management suiteIn-record conversations, @mentions and email integration keep every exchange with the Control Owner attached to the procedure it concerns, so review notes and clarifications are part of the audit file, not a separate inbox.
Audit Management suiteStand behind every finding under review
Use the AI Assistant in a SmartDoc field to generate testing summaries and deficiency narratives from your results, so the draft the Audit Manager reviews is grounded in the recorded test and your time goes to judgment.
SOX Management suiteComplete histories of testing, evidence, approvals and changes are retained, and external auditors get controlled access to results and supporting evidence, so reliance on your work is a decision they can make from the file.
SOX Management suiteGranular, role-based permissions keep sensitive workpapers and draft findings with the engagement team until release, so a finding about a department is not read by that department before the Audit Manager has signed it off.
Audit Management suiteInternal audit. Manages workpapers with evidence attached, review notes and sign-offs, and links findings to related risks, controls and process owners.
Compliance management. Reviews control execution and supporting evidence with full testing history for SOX and compliance testing.
Issues and actions. Logs observations with root causes and routes findings for management response and remediation verification.
Reporting. Produces audit-ready summaries and findings from the testing records.
Products this role uses most
Industry reference
The IIA's Global Internal Audit Standards (2024) and the CIA body of knowledge define the work: sufficient, reliable evidence; documented workpapers; findings with criteria, condition, cause and effect; and follow-up of management actions. Independence and objectivity requirements apply to every engagement.
What is tested depends on sector: FFIEC-based control areas in banks, HIPAA and billing controls in healthcare, Yellow Book compliance audits in government, and IT general controls and SOC 2 criteria in technology. In each case the auditor's workpapers may be reviewed by regulators or external auditors placing reliance on them.
Related roles
Audit Manager
See the roleExplore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
The Internal Auditor executes the test procedures in the audit program, gathers sufficient, reliable evidence in fieldwork, documents workpapers and addresses review notes from the Audit Manager. They validate that controls operated and that the supporting evidence holds, log observations with root causes and severity, link findings to the risks, controls and process owners concerned, and later verify that management's corrective actions were implemented and effective. Independence and objectivity apply to every engagement.
Internal Audit Management manages workpapers with evidence attached, review notes and sign-offs, and links findings to related risks, controls and process owners. Each test step carries its evidence, the Audit Manager's review notes sit against the workpaper they concern, and sign-off is recorded when they are cleared. Because findings link to the control and process owner, the auditor is not re-describing the control in every workpaper, and an external auditor placing reliance can follow the trail.
SOX Compliance reviews control execution and supporting evidence with full testing history, so the Internal Auditor can see how a control tested in prior periods, what evidence was accepted and whether exceptions recurred before testing it again. Compliance Assessments & Testing covers the wider compliance testing on the same model. The Controls Testing Lead and Control Owner work from the same records, so the evidence request and the evidence supplied are in one place.
Observations are logged with root causes in Issues Management and routed for management response and remediation verification, so a finding carries the criteria, condition, cause and effect, the owner's response and the evidence of remediation. The Internal Auditor verifies closure against that evidence rather than taking a status update on trust, and the follow-up the IIA's Global Internal Audit Standards require is a step in the record, not a separate project months later.
SmartSuite produces audit-ready summaries and findings from the testing records, so the Internal Auditor's report to the Audit Manager is drawn from the workpapers, observations and management responses as they stand. The Compliance Analyst and Risk Analyst who worked alongside the engagement see the same findings linked to their risks and controls, and the summary that goes forward is traceable back to each test step and its evidence.
New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For an audit team the first workflow is one engagement: load the audit program for the next engagement with its test steps and the control owners who will supply evidence, then run that engagement in the system so review notes and sign-offs happen there. Prior findings can be loaded so follow-up verification has its history.