Internal and Forensic Audit · Internal Audit: Introduction and Overview

Internal Audit Standards and Engagement Process: Planning to Reporting

Updated 11 October 2026 · Fact-checked

Internal audit standards are professional rules that set how an internal audit is planned, performed and reported. The engagement process runs in four stages: planning, execution (fieldwork), reporting and follow-up. In the exam, name the standard or principle, apply it to the facts, and state the stage and conclusion.

Understand Internal Audit Standards and Engagement Process

An internal audit is only as credible as the method behind it. Standards give that method. They tell the internal auditor what to plan, how much evidence to gather, how to document it and how to report. Two bodies matter for you: the Institute of Chartered Accountants of India (ICAI), which issues Standards on Internal Audit (SIAs), and The Institute of Internal Auditors (IIA), which issues the global International Standards for the Professional Practice of Internal Auditing.

The ICAI SIAs are grouped into four series. The 100 series covers standards on key concepts, the 200 series covers standards on internal audit management, the 300 series covers standards on the conduct of audit assignments and the 400 series covers standards on specialised areas. Reporting standards, such as those on documentation, communication with management and reporting results, fall within the 300 series. Learn the groups first. The individual numbers follow from them. Check the current list in the ICSI study material before the exam, because ICAI revises and adds standards.

The IIA standards work on a similar logic: they cover the purpose, independence, proficiency, quality, performance of work and communication of results. Where the ICAI SIAs bind its members, the IIA standards are a global benchmark. Use them to support your answer, not to replace the ICAI position unless the question asks for IIA.

The engagement process is the life cycle of one assignment. It starts when the auditor accepts the work. An internal audit charter sets the function's purpose, authority and responsibility at the organisation level, usually approved by the board or audit committee. An engagement letter is specific to one assignment. It records scope, objectives, responsibilities, reporting lines and timing.

Then come four stages. In planning, you understand the entity and its risks, set scope and objectives, and prepare the audit programme. In execution, you test controls and transactions, gather evidence and record it in working papers. In reporting, you communicate findings, risks and recommendations with management responses. In follow-up, you check whether agreed actions were implemented and report open items to the audit committee.

Key rules to remember

Four stages of an engagement: Planning → Execution (fieldwork) → Reporting → Follow-up; Use this as the skeleton for any process question. Add the activities under each stage.
Series of ICAI Standards on Internal Audit: 100 Key concepts | 200 Internal audit management | 300 Conduct of audit assignments (including reporting) | 400 Specialised areas; Learn the four series themes. Confirm the current individual standards from the ICSI study material.
Charter versus engagement letter: Charter = function-level mandate | Engagement letter = assignment-level terms; Examiners often test this difference.
Evidence trail: Objective → Procedure → Evidence → Working paper → Finding → Recommendation; Every finding in a report must trace back through this chain.

How to solve Internal Audit Standards and Engagement Process questions

Use this method for any question on standards or the engagement process, whether it asks for a list, an explanation or a case-based application.

1Read the question and mark what is asked: a standard, a stage, a document or a case conclusion.
2Name the source: ICAI SIA series, IIA standard, or the stage of the engagement.
3State the rule or purpose in one or two plain sentences.
4List the key requirements or activities under it, in the order they occur.
5Apply them to the facts given, using the names, amounts and dates in the question.
6Link to documentation: say which working paper, letter or report records the point.
7Close with a clear conclusion or recommendation in one sentence.

Quickest way: Stage-and-document shortcut

When to use it: Use it when time is short or the question asks you to outline or explain the process.

Write the four stages as sub-headings.
Under each, add two or three activities and the document produced.
Planning: understanding, risk, scope, programme, engagement letter.
Execution: testing, evidence, working papers, supervision.
Reporting: draft, management response, final report.
Follow-up: action tracking, audit committee update.
Add one line naming the relevant SIA series or IIA principle.

Common mistakes in Internal Audit Standards and Engagement Process

Confusing the internal audit charter with the engagement letter.
Both are authority documents and both are signed or approved.
Fix: Say the charter covers the whole function and is approved by the board or audit committee. The engagement letter covers one assignment and agrees its terms.
Quoting SIA numbers and titles from memory without certainty.
Students memorise lists without learning the series logic.
Fix: Learn the four series themes and cite a specific standard only when you are sure of it. Explain its content in words.
Treating follow-up as optional.
The report feels like the end of the audit.
Fix: State that follow-up verifies whether management actioned recommendations and that unresolved items go to the audit committee.
Writing a generic process answer that ignores the facts.
Students rely on a memorised template.
Fix: Use the entity, risk areas and dates given in the question in each stage.
Mixing IIA and ICAI requirements as if they were the same.
Both cover similar ground with different wording.
Fix: Label each point as ICAI SIA or IIA. If the question is silent, lead with the ICAI position.

Worked examples

Example 1

Briefly explain the stages of an internal audit engagement for Sundaram Textiles Ltd., a manufacturing company, whose board has asked for a review of its purchase function.

Show the solution

Planning: understand the purchase cycle, vendor base and past issues. Assess risks such as unapproved vendors and duplicate payments. Fix scope and objectives, issue an engagement letter and prepare the audit programme.
Execution: test purchase orders against approvals, match orders, goods receipts and invoices, and review vendor selection. Record evidence in working papers and have a senior review them.
Reporting: discuss findings with purchase management, obtain responses, and issue the report with risk ratings and recommendations to the audit committee.
Follow-up: after the agreed timeline, check whether the recommended controls were implemented and report open items to the audit committee.

Answer: The engagement has four stages: planning, execution, reporting and follow-up. For Sundaram Textiles each is applied to the purchase function as shown above, and each stage produces a document: engagement letter and programme, working papers, report, and follow-up status.

Example 2

Distinguish between an internal audit charter and an engagement letter. Why does an internal auditor need both?

Show the solution

Charter: it defines the purpose, authority, responsibility and reporting line of the internal audit function. The board or audit committee approves it, and it changes rarely.
Engagement letter: it covers one assignment. It sets the scope, objectives, period, responsibilities of management and auditor, timing and reporting.
Need for both: the charter gives the function standing and access to records. The letter turns that authority into clear terms for a specific job and prevents disputes on scope.
Conclusion: the charter is the permanent mandate and the letter is the assignment contract.

Answer: The charter is the function-level mandate approved by the board or audit committee. The engagement letter records the terms of one assignment. The auditor needs the charter for authority and independence, and the letter for clarity of scope and responsibilities.

Exam tips

Structure process answers by the four stages and add the document produced at each stage.
Learn the four SIA series themes. Cite individual standards only when certain.
Expect case-based questions. Tie each stage to the facts given instead of listing generic steps.
Always mention follow-up and the audit committee reporting line. Many answers stop at the report.
Write the charter versus engagement letter distinction in two crisp lines. It is a frequent short-note topic.

Practice questions from Internal Audit: Introduction and Overview

Internal Audit Standards and Engagement Process in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Standards and Engagement Process: frequently asked questions

What are Standards on Internal Audit (SIAs)?

They are standards issued by ICAI that set the professional requirements for internal audit work. They are grouped into four series covering key concepts, internal audit management, conduct of audit assignments (including reporting) and specialised areas.

What is the difference between an internal audit charter and an engagement letter?

The charter defines the mandate and authority of the internal audit function and is approved by the board or audit committee. The engagement letter sets the terms of one specific assignment, such as scope, timing and responsibilities.

What are the stages of an internal audit engagement?

The stages are planning, execution or fieldwork, reporting and follow-up. Each stage has its own activities and documents, and the process closes only when agreed actions are checked.

Do I need to memorise all SIA numbers for CS Professional?

Focus on the series themes and the content of the main standards. Check the ICSI study material for the current list, since the exam is a written paper that rewards correct application over bare numbers.