Armoiries GaspozLAURENT GASPOZ
Skip directly to the CV

Animated experience — Internal Audit

An internal audit engagement in action

  1. 01 — Engagement scoping

    Define an engagement aligned with the organization's risks and objectives, with a clear mandate, an explicit scope and identified stakeholders.

    • Audit universe and plan — Position the engagement within the audit universe and the risk-based annual plan.
    • Objectives and scope — Translate the organization's objectives into audit objectives and set the scope boundaries.
    • Engagement letter — Formalize the mandate, scope, timeline, contacts and reporting arrangements.
    Deliverables
    Engagement letter · Audit objectives · Scope · Timeline · Stakeholder list
    Interactions
    Audit committee · Executive management · Business process owners · Risk management
    Competencies
    Risk-based planning · Understanding of context · Scope definition · Engagement governance · Communication with management
    Expected outcomes
    An engagement aligned with the organization's risks and objectives

  2. 02 — Risk assessment

    Focus the work on risks likely to affect objectives, linking each risk to key controls and available data.

    • Process mapping — Describe the steps, actors, systems and data of the process under audit.
    • Risk events — Identify failure scenarios that could jeopardize the objectives.
    • Key controls — Inventory existing controls and assess their apparent adequacy.
    • Prioritization — Rank areas to test based on residual exposure and assurance value.
    Deliverables
    Preliminary risk assessment · Process map · Risk-control matrix · Work program
    Interactions
    Business process owners · Internal control · Risk management · IT · Finance
    Competencies
    Risk analysis · Process understanding · Identification of key controls · Prioritization · Professional judgment
    Expected outcomes
    A work program focused on significant risks

  3. 03 — Fieldwork and testing

    Base conclusions on sufficient, reliable, relevant and useful evidence, documenting every test and every deviation identified.

    • Interviews — Understand actual practice and compare descriptions against observed facts.
    • Sample selection — Define a traceable sampling method and justify its representativeness.
    • Control testing — Compare the expected result to the observed result and record deviations.
    • Data analytics — Process the full population to detect anomalies and trends.
    Deliverables
    Working papers · Test results · Data analyses · Evidence register · Identified exceptions
    Interactions
    Business process owners · Finance · IT · Compliance
    Competencies
    Interviewing · Document analysis · Sampling · Control testing · Data analysis · Critical thinking · Work documentation
    Expected outcomes
    A complete, traceable and reviewed working paper file

  4. 04 — Findings and root causes

    Distinguish symptoms from causes in order to propose lasting improvements rather than one-off fixes.

    • Criterion and gap — Compare the observed condition against the applicable criterion and measure the gap.
    • Root cause — Trace the gap back to its organizational, technical or cultural cause.
    • Effect and risk — Assess the potential impact and the residual risk to objectives.
    • Contradictory validation — Have the facts validated by responsible parties before drawing any conclusion.
    Deliverables
    Finding sheet · Root cause analysis · Priority level · Impact assessment · Validation with management
    Interactions
    Business process owners · Executive management · Internal control · Compliance
    Competencies
    Root cause analysis · Synthesis · Impact assessment · Findings writing · Contradictory validation
    Expected outcomes
    Factual findings, validated and linked to an identified cause

  5. 05 — Recommendations and reporting

    Turn findings into realistic, proportionate, value-creating recommendations, accompanied by a formal management response.

    • Recommendation options — Compare several possible treatments based on cost, timeline and impact.
    • Executive summary — A one-page, decision-oriented summary: issue, risk, recommendation, expected effect.
    • Management response — Obtain the commitment, the owner, the deadline or the accepted risk.
    Deliverables
    Audit report · Executive summary · Recommendations · Management response · Action plan
    Interactions
    Audit committee · Board of directors · Executive management · Business process owners · External audit
    Competencies
    Advisory · Executive writing · Communication · Negotiation · Presentation to the audit committee · Formulating measurable actions
    Expected outcomes
    A clear, decision-oriented report with dated commitments

  6. 06 — Follow-up and assurance

    A recommendation only creates value once it is implemented and verified: follow-up closes the assurance loop.

    • Tracking register — Track open actions, owners, deadlines and delays.
    • Implementation evidence — Verify the effectiveness of the action, not merely its reported completion.
    • Closure and reporting — Validate closure and inform the audit committee of overdue actions.
    Deliverables
    Tracking register · Dashboard · Follow-up report · Closure validation · Information to the audit committee
    Interactions
    Audit committee · Executive management · Business process owners · Internal control · Risk management
    Competencies
    Implementation tracking · Accountability · Reporting to the audit committee · Continuous improvement
    Expected outcomes
    Verified assurance over the effective management of audited risks