Photo by EqualStock on Unsplash
Government agencies and state-owned enterprises (SOEs) have additional focuses on financial accountability, governance, procurement, and follow-up on audit recommendations. These differences affect the scope and methods of testing.
This article discusses a case study the audit process in manufacturing, banking, government agencies, and state-owned enterprises. The discussion demonstrates how auditors adapt procedures based on the risk characteristics of each sector. Also read: Manufacturing Audit Application: Features & How to Choose
Characteristics and Focus of Audits in Various Industrial Sectors
Internal audit They share the same goal of providing an independent assessment of controls, risks, and governance. However, the audit objectives follow each organization's business processes.
In manufacturing, auditors focus heavily on inventory, production, purchasing, distribution, and the supply chain. Audits require verification of administrative records and actual conditions on the ground.
The banking sector has distinct characteristics. Teller activities, cash management, lending, information technology systems, data security, and customer transactions require more structured oversight.
The Financial Services Authority (OJK) has positioned the internal audit function as part of bank governance. POJK 17 of 2023 covers the internal audit function, risk management, internal control, information technology systems, and strategies anti-fraud.
Meanwhile, government agencies and state-owned enterprises have a great concern for accountability in resource management and compliance with applicable regulations.
These differences require auditors to prioritize based on risk. Audit procedures are then designed to ensure the evidence obtained is truly relevant to the organization's critical areas. The following section will discuss case studies of audit processes in these three sectors to demonstrate a practical approach that can be applied.
Case Study 1: Implementation of Internal Audit in the Manufacturing Industry
The following audit process case study depicts a manufacturing company with multiple warehouses for raw materials and finished products. Management wants to ensure accurate inventory records and proper procurement processes through structured internal audits.
The internal audit team can begin the audit by conducting a risk mapping exercise. Auditors identify vulnerable areas such as stock discrepancies, inappropriate purchases, damaged goods, and supply delays.
Inventory and Supply Chain Audit Planning
The planning stage begins by determining the objectives, scope, audit period, and business processes to be tested. The auditor then maps risks based on the company's operational characteristics.
For inventory, auditors can compare stock cards, system reports, goods receipt documents, and physical counts. Discrepancies between records are indicators that need to be investigated.
Audits can also cover the purchasing process through to receiving raw materials. Auditors assess whether authorization, supplier selection, ordering, receiving, and recording have followed procedures.
In the supply chain, attention goes beyond the quantity of goods. Timely delivery, material quality, dependency on specific suppliers, and transaction documentation can also be examined.
The mapping results help auditors identify areas of higher risk. This approach allows audit time to be directed to processes with the greatest potential for loss or operational disruption.
Implementation of Fieldwork, Factory Inspection, and Internal Control Testing
Once the plan is approved, the auditor enters the audit phase. fieldwork. The audit may involve interviews, observations, document inspections, physical counts, and transaction testing. You may also read: Audit Procedures: Definition, Stages, Types, and Examples
In the warehouse area, auditors can perform stocktaking or inventory sample count. The results are then compared with system records to identify any discrepancies that need to be explained.
Factory inspections also help auditors understand the production process firsthand. Auditors can observe the flow of raw materials, machine usage, access controls, and even the segregation of duties between employees.
Internal control tests are conducted to determine whether established procedures are actually being implemented. For example, auditors examine evidence of purchase approvals and receipts of goods.
If an inventory discrepancy is discovered, the auditor does not immediately conclude fraud. The cause must be investigated through documentation, interviews, observations, and additional testing.
This approach makes audit results more objective. Final findings can be supplemented by relevant conditions, criteria, causes, impacts, and recommendations for improvement.
Case Study 2: Internal Audit Process in the Banking and Financial Sector
A case study of the audit process in the banking sector demonstrates the need to consider transaction complexity, regulations, information security, and operational risks. Each activity has controls that need to be periodically tested through a comprehensive audit approach.
The Financial Services Authority (OJK), through POJK 17 of 2023, requires banks to implement an independent and objective internal audit function. This provision also covers risk management and internal control systems.
The implementation guidelines are strengthened through SEOJK 14/SEOJK.03/2025. These provisions cover the internal audit function, SKAI structure, independence, competence, and monitoring of follow-up on audit findings.
Regulatory Compliance Evaluation (OJK/BI) and Teller/Vault Operational Supervision
One example of an audit might focus on teller activities and cash management. Auditors evaluate the compliance of operational procedures with internal policies and regulatory requirements.
Areas examined may include cash transactions, cash reconciliation, storage room access, evidence of authorization, and the conformity of physical balances with administrative records.
In the area vault, access control is a critical concern. Auditors may examine access lists, opening and closing documentation, cash flow recording, and the application of the principle of segregation of duties.
Compliance audits don't stop with documentation. Auditors need to assess the implementation of procedures in daily activities through observation and testing of sample transactions.
If a nonconformity is found, the auditor needs to determine the root cause. Findings may relate to procedural weaknesses, lack of supervision, administrative errors, or ineffective controls.
IT System Control Testing and Suspicious Transaction Mitigation
The digitalization of banking has made information technology systems a crucial part of audits. Auditors need to assess access controls, authorization, system changes, activity logging, and information security.
Testing can include user accounts and access rights. Auditors ensure that authority is assigned according to job functions and does not create excessive access.
In addition to IT controls, auditors can examine transaction monitoring mechanisms. Unusual activity should be analyzed based on established parameters and procedures.
POJK 17 of 2023 also includes strategies anti-fraud, risk management, internal control, and integrity of reporting and information technology systems within the framework of bank governance.
The audit results then form the basis for recommendations. Improvements may include adjusting access rights, strengthening authorizations, increasing monitoring, or refining procedures.
Case Study 3: Internal Audit of Government Agencies and State-Owned Enterprises
This third audit case study demonstrates the broad scope of internal audits in government agencies and state-owned enterprises. Auditors not only review transactions but also assess compliance, control effectiveness, and governance of public sector organizations.
In the public sector, procurement of goods and services is a crucial area. Transaction values, selection stages, contracts, and even acceptance of work require adequate evidence.
For state-owned enterprises (SOEs), audits can be tailored to the characteristics of their business activities and internal control mechanisms. The focus should still be on considering the organization's risks and objectives.
Compliance with State Financial Governance and Procurement of Goods/Services (PBJ) Audits
In procurement audits, auditors can trace the process from requirements planning to payment. Each stage is compared against the policies and regulations that underpin implementation.
For example, auditors examine planning documents, supplier selection, contracts, evidence of work, minutes, and payment documents.
These tests help identify potential problems such as incomplete documents, processes that do not comply with regulations, specifications that are not met, or payments that are not supported by adequate evidence.
A risk-based approach is also increasingly relevant in internal government oversight. The National Public Accounting Agency (LKPP), for example, has an Annual Risk-Based Oversight Work Program for 2026, which includes performance and compliance audits.
The auditor then compiles findings based on the evidence obtained. Each recommendation should be directed at the root cause of the problem so that improvements can be monitored objectively.
Preparation of LHP (Audit Result Report) and Monitoring of SPI/BPK Follow-up Actions
The reporting stage is crucial because the audit results need to be communicated to the responsible parties. The report must clearly present findings, conclusions, and recommendations.
The BPK explained that the Audit Result Report or LHP functions to communicate the audit results and also serves as a basis for corrective action and follow-up monitoring.
Follow-up shouldn't stop at the "fixed" status. Auditors need to see evidence of completion and assess whether the actions actually address the recommendations.
BPK Regulation Number 2 of 2017 regulates the monitoring of follow-up actions on audit recommendations. Officials are required to submit a response or explanation along with supporting evidence no later than 60 days after receiving the audit report.
The BPK also continues to emphasize the importance of following up on recommendations as part of the audit's benefits. In 2026, the BPK stated that implementing recommendations would be a crucial step in achieving tangible improvements in governance.
For the SPI function, a similar mechanism can be implemented by recording recommendations, responsible parties, deadlines, proof of completion, and follow-up status.
Comparison Matrix of Audit Challenges Across Industries
From the various audit case studies described, each sector requires a different approach because the sources of risk are diverse. The following comparison helps identify areas of typical auditor concern based on the characteristics of each industry.
| Sector | Primary Focus | Audit Challenges | Example of Evidence |
| Manufacturing | Inventory, production, supply chain | Difference between stock and process spread | Stock cards, PO, invoices, inspection results |
| Banking | Transactions, cash, IT, compliance | Transaction volume and system complexity | System logs, transaction evidence, reconciliation |
| Government | Finance and PBJ | Compliance and completeness of documentation | Contracts, PBJ documents, proof of payment |
| State-Owned Enterprises | Operational, financial, governance | Business complexity and oversight | Reports, contracts, SOPs, evidence of follow-up |
The matrix demonstrates the need for a flexible approach for auditors. Audit methods can be tailored based on risk, materiality, business processes, and control quality.
The main similarity lies in the need for adequate evidence and a measurable follow-up process. Without such documentation, audit results hardly provide a solid basis for improvement.
Conclusion
From various case studies Audit processes in manufacturing, banking, government, and state-owned enterprises (SOEs) demonstrate that each sector has distinct risk characteristics. However, all require a structured and consistent audit process to generate impactful recommendations.
Starting from planning, fieldwork, testing, documentation, reporting, to follow-up, each stage produces information that needs to be managed consistently.
The use of digital platforms can help auditors reduce repetitive administrative work. Documents, working paper, findings, recommendations, and follow-up status can be managed in one work environment.
Audithink can be a solution for organizations looking to modernize their audit processes by managing audit activities in a more structured manner. Audit information can be managed, making it easier for teams to monitor progress and follow-up.
If your organization is facing an audit process that is still scattered across various documents and spreadsheets, it's time to consider a more integrated approach.
Learn about digital audit solutions through Audithink or consult your organization's needs through Audithink demo page.
FAQ
What is meant by audit process case study?
An audit process case study is an example of the application of audit stages to a specific condition or sector to show how auditors identify risks, test controls, and develop recommendations.
How is the manufacturing internal audit process conducted?
Manufacturing internal audits may include risk-based planning, inventory checks, production inspections, testing of controls, documentation of findings, and monitoring of recommendations.
What is the focus of the banking internal audit process?
Banking audits can focus on transactions, cash, compliance, risk management, internal controls, information technology systems, and strategy implementation. anti-fraud.
Why is it necessary to conduct internal audits of government agencies?
Internal audits help provide assurance and recommendations for improvements to the management of activities, compliance, control, and use of organizational resources.
What is the role of BUMN internal audit in governance?
BUMN internal audits help evaluate the effectiveness of controls, risk management, compliance, and business processes so that weaknesses can be corrected in a measurable manner.
How is the follow-up of audit results monitored?
Follow-up can be monitored by recording recommendations, responsible parties, deadlines, proof of completion, and status verification by the relevant supervisory function.
