Internal Auditing: A Practical Approach

Amit M. Mehta’s Internal Auditing: A Practical Approach connects governance, risk and controls with the planning, execution and communication of audit work. Twelve chapters and two applied appendices develop an engagement from organisational context to evidence, reporting, follow-up and emerging audit methods.

How to study this book

Keep an audit file for a fictional organisation throughout the book. Separate objectives, risks, controls, procedures, evidence and conclusions so that each recommendation can be traced to a finding. Attempt the scenarios before reviewing the discussion. Treat the standards described as source-edition material and check current authoritative requirements before using them in professional work.

Chapter-wise explanations and study tasks

Chapter 1 — Introduction to Internal Auditing

The opening chapter defines internal auditing as an independent and objective activity concerned with governance, risk management and controls. Its evolving scope goes beyond checking financial records. Understand who receives assurance, which responsibilities remain with management and why independence matters even when the audit function belongs to the organisation.

Study task: Write an audit-function purpose statement and distinguish its responsibilities from those of management.

Chapter 2 — Professional Standards, IPPF and Ethical Considerations

Professional frameworks, ethical conduct and quality assessment establish expectations for dependable audit work. The chapter connects principles with practical decisions and continuing learning. Knowing a standard’s title is insufficient if an engagement cannot demonstrate how it was applied. Keep the edition’s framework terminology distinct from any later professional revision.

Study task: Analyse a fictional conflict of interest and propose safeguards that preserve objectivity and transparent reporting.

Chapter 3 — Corporate Governance

Boards, management, oversight and compliance arrangements shape how an organisation is directed and held accountable. Internal audit contributes assurance without taking over the decisions it may later evaluate. Map formal responsibilities alongside the information people actually receive, since a committee’s existence does not establish effective oversight.

Study task: Draw a governance map showing decisions, reporting lines and where independent assurance enters.

Chapter 4 — Risk Management

Risk identification, assessment, response and monitoring connect objectives with uncertainty. The internal auditor evaluates the process while management remains responsible for owning and responding to risk. A risk score is a judgement built from assumptions, not an objective fact detached from the organisation’s context.

Study task: Create a risk register with objectives, causes, consequences, responses and evidence that the response is working.

Chapter 5 — Internal Controls

Controls address risks through design and operation within a broader control environment. Preventive and detective activities serve different purposes, and an apparently sound procedure may fail in daily use. The chapter connects testing with financial integrity and the audit role. Evaluate residual risk rather than assuming that listing more controls always means better protection.

Study task: Choose one process, distinguish control design from operating effectiveness and propose a test for each.

Appendix 5A — Identifying Risks and Implementing Controls

The appendix applies risk-and-control reasoning across procurement, sales, human resources, reporting, inventory, technology, cash, assets, strategy and governance. Use the examples to practise a consistent method while retaining process-specific differences. A control suitable for one context should not be transferred without checking the objective and actual risk.

Study task: Compare two process areas and explain why an apparently similar control would require different evidence.

Chapter 6 — Managing the Internal Auditing Function

Structure, leadership, strategic direction, quality programmes and change affect whether an audit function can deliver its mandate. Staffing and resources need to match the work expected, while quality improvement should identify practical weaknesses. Distinguish managing the function from planning a single engagement.

Study task: Develop a skills-and-resource plan for a small audit function and explain one gap that would require specialist support.

Chapter 7 — Internal Audit Planning and Strategy

Risk-based planning prioritises assurance needs under limited resources. Scope, objectives, coordination and changing conditions connect a strategic plan with individual engagements. A calendar of audits is not automatically risk-based: the rationale for coverage and omissions must be visible. Update priorities when the underlying assumptions change.

Study task: Rank proposed engagements using explicit criteria and explain which important risk remains outside the available capacity.

Appendix 7A — A Multi-year Risk-based Audit Plan for a Retail Chain

The retail case combines organisational background, risk assessment, engagement selection and resource scheduling. Its value is the connection among these elements rather than the particular years in its sample plan. Test whether the planned work addresses the identified priorities and whether resources make the proposed schedule feasible.

Study task: Challenge one choice in the case plan and propose a justified alternative with its resource consequence.

Chapter 8 — Performing the Audit: Approach, Techniques and Tools

Audit execution turns objectives into procedures and evidence. Sampling, analytics and other tools must fit the question and the population being examined. A tool’s output does not itself establish a finding: the auditor must evaluate relevance, reliability and limits. Make the link from an objective to each planned procedure explicit.

Study task: Design a procedure for one audit objective, specifying the population, evidence and limits of the conclusion.

Chapter 9 — Performing the Audit: Functional, Operational or Business Areas

Financial, operational, technology, human-resource and sector-specific audits require different process knowledge. Apply a common audit discipline without assuming that a standard checklist fully captures every area. Understand what success means for the function being reviewed and how its risks could prevent that success.

Study task: Adapt one audit objective to two different functions and identify the specialised evidence each requires.

Chapter 10 — Reporting, Communication and Follow-up

An audit report makes findings and their significance understandable to people able to act. Effective follow-up tests whether an action addresses the underlying issue rather than merely whether it was marked complete. Visualisation and stakeholder communication support that purpose, but clarity should not erase uncertainty or exaggerate the evidence.

Study task: Draft a finding connecting condition, criterion, cause and consequence, then specify evidence needed to verify corrective action.

Chapter 11 — Public and Not-for-Profit Auditing

Public accountability and mission-based organisations introduce objectives and relationships not captured by profit alone. Performance, compliance, stewardship and ethical considerations require attention to mandates and beneficiaries. Distinguish an efficient process from an effective public outcome, and state whose interests the audit is meant to protect.

Study task: Design an audit question for a public programme using economy, efficiency and effectiveness as distinct considerations.

Chapter 12 — Analytics, Agile Auditing and Continuous Auditing

Advanced approaches can make audit work more responsive and data-rich, but they still depend on evidence quality, suitable objectives and professional judgement. Continuous auditing differs from management’s continuous monitoring. Evaluate what a new method improves and what risks it introduces rather than assuming automation resolves independence or interpretation.

Study task: Compare a periodic manual test with a continuous analytical test, identifying data requirements and possible false signals.

Applied assignment

Assemble an engagement file containing a risk-based rationale, scope, procedures, sample evidence, a finding and a follow-up plan. Explain how the work supports assurance without assuming management’s responsibilities.

Suggested reading plan

Read Chapters 1–5 for foundations and use Appendix 5A for practice. Continue through management and planning with the retail case, then execution and reporting. Finish with sector differences and advanced methods, revising the engagement file at each stage.

Questions for reflection

• What is the difference between a management control and an audit procedure?
• How far does the evidence support the proposed conclusion?
• When can a completed corrective action leave the original risk unresolved?

Edition and source notes

Based on Mehta’s 2024 Conestoga resource, covering twelve chapters and Appendices 5A and 7A. The guide explains the source’s framework and cases without claiming that its professional-standard descriptions are current. These original study activities are not reproduced case answers or professional audit advice.

Consult the official source and full text.