Internal Audit could deal with the business process or supplier audit. Before jump to fieldwork, you need to understand the business process procedure of the specific department. In order to do that, you can listen or read and then conclude your understanding by drafting a flow chart or just follow the business process procedure existing chart. Look for the existing control in place at every process, let say invoice payment have 9 process, ensure if all the 9 process have sufficient control to prevent error, segregation of duties, tools to process, input and output of each process. Then, you ask for sample of data 1 or 2 for input and output in each process, ensure they follow the procedure of what the objective, why, when it process and how it process. Then try to think what is the impact or risk if the output is not processed based on the procedure. Ask to processor if there is exceptional case with supporting evidence if the anomali approved by higher authority. If not then ask why they do so, give recommendation for improvement. Again think about the small or big impact of the faulty. If it is small and few in terms of quantity (not repetitive) then just remind with unofficial email for improvement recommendation, no need to put in audit report.
