Internal and Forensic Audit · Practices related to Internal Auditing

Internal Audit Techniques and Tools for CS Professional

Updated 11 October 2026 · Fact-checked

Internal audit techniques are the methods an auditor uses to collect evidence: inquiry, observation, inspection, confirmation, recomputation, reperformance, analytical procedures and computer-assisted audit techniques (CAATs). To answer a question, name the technique, say how it works, state what it proves, and note its limits for the facts given.

Understand Internal Audit Techniques and Tools

An internal auditor cannot form a view from opinions alone. Every conclusion needs audit evidence. A technique is the method you use to get that evidence. A tool is the aid that helps you apply the method, such as a checklist, a flowchart, a sampling plan or audit software.

The basic techniques are simple. Inquiry means asking people, inside or outside the entity. Observation means watching a process being done, such as stock counting or goods receipt. Inspection means examining records, documents or physical assets. Confirmation means getting a direct reply from a third party, such as a bank or a customer. Recomputation means checking arithmetic accuracy. Reperformance means doing a control or process again yourself.

Analytical procedures compare data to find unusual movements. You compare current figures with past periods, budgets, industry data or related figures, such as sales against receivables. A large unexplained difference tells you where to dig deeper. Analytics alone is rarely enough proof. It points to risk and does not close the matter.

Data analytics and CAATs apply software to whole data sets. Instead of testing 25 invoices, the auditor can scan every invoice for duplicates, gaps in sequence, weekend postings or payments above approval limits. Common tools are spreadsheets, audit software and test data. Reviewing the full population gives wider coverage. Its weakness is that results depend on data being complete and accurate, and on the auditor's skill.

No single technique is best. Inquiry is quick but weak evidence on its own, since people may be wrong or biased. Inspection of external documents is stronger than internal ones. Observation shows a control working only at that moment. A good auditor combines techniques, and the choice depends on risk, cost, time and the reliability of evidence needed.

Key rules to remember

Variance in analytical procedure: Variance = Actual − Expected; Variance % = (Actual − Expected) ÷ Expected × 100; Investigate when the variance exceeds the threshold set in the audit plan. The threshold is a judgement and not a fixed number.
Reliability of evidence (rule of thumb): External, written and directly obtained evidence is generally more reliable than internal, oral and indirectly obtained evidence; It is a general guide and not a law. Reliability also depends on the controls over the source.
Gross profit ratio: Gross profit ratio = (Sales − Cost of goods sold) ÷ Sales × 100; A common analytical test. A sudden change may signal misstatement, pricing change or cut-off error.
Receivable days: Receivable days = Average trade receivables ÷ Credit sales × 365; A rise may indicate weak collection or fictitious sales. Use credit sales and not total sales where possible.

How to solve Internal Audit Techniques and Tools questions

Use this method for any question that asks you to select, explain or apply an audit technique.

1Identify the objective: what assertion or risk is being tested, such as existence, completeness, accuracy or control operation.
2Name the technique that fits the objective, for example observation for a physical process or inspection for documents.
3Explain how you would apply it to the facts in the question, with specifics such as which records, which period and which population.
4State what evidence you get and how reliable it is, noting its source and form.
5Add a supporting technique, since one technique rarely suffices, for example reperformance after inquiry.
6State the limitations and the follow-up if exceptions arise.
7Conclude with the recommendation or the next audit step, and mention documentation in working papers.

Quickest way: Objective, Technique, Evidence, Limit

When to use it: Use it when you have little time and the question asks which technique to use or why.

Write the objective in one line.
List two or three suitable techniques, with one line on how each is applied.
Mark the strongest evidence and say why.
Add one limitation, such as bias in inquiry or poor data quality in CAATs.
End with one line on the conclusion or follow-up.

Common mistakes in Internal Audit Techniques and Tools

Treating inquiry as sufficient evidence
It is the easiest technique and students assume a manager's answer is proof.
Fix: State that inquiry must be corroborated by inspection, observation or reperformance.
Confusing inspection with observation
Both involve looking at something.
Fix: Inspection is examining records or assets. Observation is watching a process being performed.
Saying analytical procedures prove a balance is correct
Ratios look precise, so students overstate them.
Fix: Say they identify unusual items and direct further testing. They seldom prove accuracy alone.
Presenting CAATs as replacing the auditor's judgement
Technology is seen as automatic.
Fix: Explain that the auditor designs the tests, validates data completeness and interprets exceptions.
Listing techniques without applying them to the case facts
Students recite definitions from memory.
Fix: Tie each technique to the specific process, risk and records in the question.
Ignoring limitations and cost
Students focus only on what each technique does.
Fix: Add one line on limits, such as observation reflecting only one moment, and on cost or skill needed.

Worked examples

Example 1

Sales of Rohan Traders Ltd were ₹8,00,000 last year and ₹10,00,000 this year. Cost of goods sold was ₹6,00,000 last year and ₹8,50,000 this year. Using analytical procedures, comment on the position.

Show the solution

Last year gross profit = 8,00,000 − 6,00,000 = ₹2,00,000.
Last year gross profit ratio = 2,00,000 ÷ 8,00,000 × 100 = 25%.
This year gross profit = 10,00,000 − 8,50,000 = ₹1,50,000.
This year gross profit ratio = 1,50,000 ÷ 10,00,000 × 100 = 15%.
Sales rose 25% but the ratio fell by 10 percentage points, which is a significant unexplained variance.
Possible causes are understated sales, overstated purchases or closing stock errors, price cuts, or cost misclassification.
Follow up by inquiry with management, inspection of purchase and sales documents, and testing of stock cut-off.

Answer: The gross profit ratio fell from 25% to 15%. This is an unusual movement that needs investigation through inquiry, inspection and cut-off testing. The ratio alone does not prove any misstatement.

Example 2

As internal auditor of Meera Pharma Ltd, you must test its accounts payable ledger of 40,000 invoices for duplicate payments. Explain how you would use CAATs and why this is better than manual sampling here.

Show the solution

Objective: detect duplicate or unauthorised payments, a risk to accuracy and occurrence.
Obtain the full payables and payment data and check its completeness by agreeing record counts and totals to the general ledger.
Use audit software to find invoices with the same vendor, invoice number and amount, or same vendor and amount within a short period.
Also run tests for payments above approval limits, round-sum amounts and gaps in invoice sequence.
Review each exception by inspecting the invoice, the purchase order and the goods receipt, and make inquiries.
Document the data source, test logic, results and conclusions in working papers.
Benefit: the whole population is tested, so coverage is wider than a sample and exceptions are less likely to be missed.
Limit: results are reliable only if data is complete and accurate, and exceptions still need human judgement.

Answer: Run duplicate and limit tests on the full 40,000 invoices after validating data completeness, then verify each exception with documents. CAATs give full coverage that a sample cannot, but depend on data quality and auditor judgement.

Exam tips

Link each technique to a stated objective. Marks go to application, not definitions.
Use short lists with one line per technique, and add its limitation.
When ratios are given, compute them first, then comment on the movement and the follow-up.
For CAAT questions, mention data validation, test design, exception review and documentation.
Mention the reliability of evidence when comparing techniques, as examiners often ask which is stronger.

Practice questions from Practices related to Internal Auditing

Internal Audit Techniques and Tools in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Techniques and Tools: frequently asked questions

What is the difference between audit techniques and audit tools?

A technique is the method used to obtain evidence, such as inquiry or inspection. A tool is an aid that supports the method, such as a checklist, flowchart or audit software. Questions often use both words, so link each tool to the technique it supports.

What are CAATs in internal audit?

CAATs are computer-assisted audit techniques. They use software or test data to examine records, find exceptions and test system controls. They are most useful when the volume of data is large.

How do I use analytical procedures in internal audit?

Compare actual figures with an expectation built from past data, budgets or related figures. Calculate the variance, decide whether it exceeds the threshold, and investigate the cause. Back up the explanation with other evidence.

Is data analytics the same as CAATs?

They overlap but are not identical. CAATs is the older and wider term for any computer-based audit method. Data analytics usually means analysing large data sets to find patterns and anomalies, often across the full population.