Internal audit, reframed.
Our practice, in detail.
1. Five years ago.
Five years ago, an internal audit brief sounded a particular way. "Cover the standard areas - procure-to-pay, order-to-cash, inventory, payroll. Test the controls. Send us the report." The audit was a maintenance activity. Findings were filed, response columns were filled, and the next cycle began.
The report often ran to 60-80 pages. The executive summary listed observations rated H/M/L. The audit committee read the H items, asked one or two questions, and moved on.
2. What changed.
Two things broke the pattern.
The first was Internal Financial Controls. Once the board had to say the IFCs were adequate and the auditor had to opine on operating effectiveness, somebody had to actually do the work. Internal audit got promoted from maintenance to evidence-producing. The reports started to matter in a way they hadn't before.
The second was the audit committee itself. In promoter-led businesses, audit committees that were once a formality became, in some firms, the most rigorous review forum on the calendar. Independent directors started reading the reports cover to cover. They started pushing back on management responses. They started asking why the same finding had appeared three cycles in a row.
And then the audit-committee chair would call the internal auditor directly. What's actually going on with this?
3. The new brief.
The brief that works in 2026 doesn't sound like a checklist. It sounds like a question:
"Here's what I worry about. Here's what I think is going on. Tell me whether I'm right."
The auditor's job is to investigate the worry - not to file 60 pages on adjacent matters. The findings are sharper, the report is shorter, and the close-out with the audit committee is a conversation, not a presentation.
That is what an internal audit looks like, reframed.
Frequently asked
What does 'reframed' mean in practice?
It means moving from a checklist-driven audit to one organised around the audit committee's specific concerns and the business's specific risks. The audit programme still has structure - but the priorities are set by the question being asked, not by a template.
Are reports shorter as a result?
Yes. A well-reframed internal audit report typically runs to 15-25 pages including annexures, with a one-page executive summary. The shift is from comprehensiveness to relevance.
