Internal audit of controls: what the decision maker looks at
An internal audit of controls checks whether the safeguards your organisation put in place for personal and sensitive data still work as designed. The decision maker reads three things: which controls were tested, what gap the auditor found, and what remediation deadline the report sets. Everything else is detail that supports those three facts.
What changes once the audit starts
Once the scope is confirmed, the systems under review move into a testing window. Configuration changes to those systems are normally frozen for the duration, because a change made mid-audit invalidates the test result. Staff named in the audit plan become interview subjects, not just system owners. The clock that matters most is not the audit's own length — it is the remediation deadline attached to each finding once the report closes.
The point of no return sits at report sign-off. Before sign-off, findings are drafts and can be reworded or reclassified. After sign-off, a finding is a fact on record, and the remediation plan attached to it becomes the thing the board is measured against at the next review.
What to do
- Compliance officer confirms the audit scope and the systems in scope before evidence requests go out.
- IT lead freezes configuration changes to the systems under review for the testing window.
- Data owner assembles access logs, incident records and prior audit findings within five working days.
- Auditor tests each control against the criteria set in the audit plan and records the result.
- Compliance officer reviews draft findings before the report is finalised.
- Management board signs off the remediation plan and assigns an owner to each open item.
Typical stages, documents and timing
| Stage | Document produced | Typical timing | Who signs off |
|---|---|---|---|
| Scoping | Audit plan | 1–2 weeks before testing starts | Compliance officer |
| Evidence gathering | Evidence log | During the testing window | Data owner |
| Testing | Control test results | 2–6 weeks, depending on scope | Auditor |
| Draft findings | Draft report | 1–2 weeks after testing ends | Compliance officer |
| Remediation plan | Action plan with owners and deadlines | Set at sign-off | Management board |
Who decides, and by when
The management board is the forum that closes the loop, not the auditor. The auditor records what it found and how severe it treats each gap. The board decides whether a finding is closed, downgraded to a watch item, or escalated to the executive committee. Boards that meet monthly close remediation plans at the next scheduled meeting. Boards that meet quarterly usually record a written interim decision, so remediation is not stalled for three months waiting for a calendar slot.
Common forks
If the audit uncovers a control gap tied to a licensing arrangement with a third party, the review often overlaps with royalty accounting. Tax clearance for royalty flows follows a comparable sign-off structure and is worth reading alongside this one.
If a dispute is already running when the audit starts, the sequencing changes what the auditor can rely on. A party that receives papers after the other side has already moved sits in a different position from one that files first; see When the other side moved first in this situation for how that plays out.
If the gap concerns a technology contract backed by an escrow arrangement, remediation may require the escrow agent to release or amend deposited material. Escrow set-up: what the decision maker looks at sets out how that decision is made and by whom.
If the organisation is preparing a token offering while the audit is running, the two workstreams share a document trail and often the same reviewers. Offering document preparation token issuance documents to prepare lists what the offering side needs separately.
What this page does not decide
This page describes how an internal audit of controls typically runs. It does not set the specific control standard your organisation must meet — that depends on the systems in scope and the data involved, and it changes as those change. It does not replace a decision by your board or your compliance function on any individual finding.
Verified
This page was reviewed for accuracy on 4 November 2025. It describes a common internal audit sequence and does not rely on a specific external source, in line with how procedural pages on this site are written.
FAQ
How long does an internal audit of controls take in practice?
Scoping usually takes one to two weeks. Testing runs two to six weeks depending on how many systems are in scope. Draft findings follow within one to two weeks of testing ending. The remediation plan itself is not on a fixed clock — it runs until every assigned owner closes their item.
Which documents are needed to start?
The audit plan, a current systems inventory, access logs for the systems in scope, records of prior incidents, and the findings from the last audit if one exists. Missing any of these does not stop scoping, but it does push the testing window back.
What happens if the other side does not respond to an evidence request?
If a third-party processor or vendor does not provide requested evidence within the testing window, the auditor records the item as unverified rather than closed. The compliance officer escalates directly to the vendor's account owner and sets a fixed cut-off date. A finding resting on unverified evidence stays open until the evidence arrives or the control is retested.
Related publications
Certification readiness: what the decision maker looks at covers the parallel process for teams preparing for external certification rather than an internal review.
Next step
Rasa Tumenaite reviews internal audit scope requests directly. A first response arrives within minutes during office hours, and a written estimate of timing follows within one working day.