Audit stages are the steps taken to ensure the audit process runs well and according to standard, generally consisting of four main stages: planning, execution, reporting, and follow-up.
In this article, we will discuss the stages of internal audit, the stages of external audit, the stages of correct audit, the stages of management audit, and the stages of performance audit.
For internal audit, the main reference is the 2024 Global Internal Audit Standards (GIAS) from The IIA, effective since 9 January 2025. For external audit of financial statements, the reference is the Audit Standards (SA) issued by IAPI.
What Is An Audit?
Audit is a systematic process for evaluating and examining an organization's financial, operational, and performance records. Audits can be divided into two main types, namely, internal audit and external audit.
Internal audits are conducted by teams within the organization to ensure compliance and operational efficiency.
External audit is carried out by a third party, namely an independent auditor from a Public Accounting Firm, to give an opinion on the fairness of the organization's financial statements.
What Are the Stages of Internal Audit?
Internal Audit is an evaluation process conducted by the audit department in an organization to assess the effectiveness of internal controls, risk management, and governance.
The main objective is to ensure that operational processes run in accordance with established policies and procedures and to detect areas of improvement. Here are the common stages of internal audit:
1. Audit Planning
Planning internal audit is the first stage in an internal audit that involves establishing the objectives, scope, and methods of the audit. At this stage, the internal auditor identifies the areas to be audited based on the risk analysis and priorities of the organization.
- Setting goals and scope: The Auditor determines the specific objectives of the audit, such as ensuring compliance with company policies or assessing the effectiveness of internal controls. The scope of the audit includes the area or department to be audited.
- Prepare Audit Program: The audit Program is structured to detail the steps to be taken during the audit, including the testing procedures and data collection techniques to be used.
2. Audit Implementation
At the implementation stage, auditors collect and analyze audit evidence to assess the effectiveness of internal controls and compliance with policies.
- Collection Of Evidence: Auditors collect evidence through interviews, observation, and document examination. Strong and relevant audit evidence is required to support the audit findings.
- Compliance and substantive testing: Compliance testing is performed to ensure that policies and procedures are followed correctly. Substantive testing is carried out to verify the reasonableness of account balances and transactions.
3. Audit Reporting
After the audit is completed, the auditor compiles a report summarizing the findings, recommendations, and conclusions of the audit.
- Prepare Audit Report: Audit report contains a summary of audit findings, analysis, and improvement recommendations. This report is submitted to management and related parties.
- Discussion Of Audit Results: Auditors discuss with management to explain findings and recommendations and get feedback from management.
4. Follow-Up Audit
The final stage in the internal audit is the follow-up to ensure that the audit recommendations have been properly implemented.
- Monitoring The Implementation Of Recommendations: The Auditor monitors the implementation of the audit recommendations to ensure that improvements have been made in accordance with the recommendations.
- Re-Audit if necessary: If necessary, the auditor may re-audit to ensure that all issues have been adequately resolved.
What Outputs and Documents Come From Each Stage of an Internal Audit?
Each stage of an internal audit produces certain documents. The following list reflects common practice, not a quotation of the standards.
| Stage | Output or document | GIAS 2024 reference (Domain V) |
|---|---|---|
| Planning | Risk-based annual audit plan, audit work program, and engagement notification | Principle 13, Plan Engagements Effectively |
| Implementation | Working papers, audit evidence, and the results of interviews and testing | Principle 14, Conduct Engagement Work |
| Reporting | Draft findings, discussion with the auditee, and the audit results report | Principle 15, Communicate Engagement Results and Monitor Action Plans |
| Follow-up | Action plan matrix, remediation status, and verification results | Principle 15, Communicate Engagement Results and Monitor Action Plans |
Planning takes place at two levels: a risk-based annual audit plan for the whole organization, and planning for each engagement.
See also:
- 8 Stages of Preparing an Audit Plan, Functions, and Examples
- Know the concept of Risk Based Audit and its examples & stages
- Audit Program (Internal Audit Work Program): Definition, Types, Examples, and How to Prepare One
- Audit Working Papers: Definition, Function, Purpose, and Types
- Audit Evidence: Definition, Types, Characteristics, and Examples
How Is an Internal Audit Reported and What Does the Report Contain?
An internal audit results report generally contains the objectives, scope, conclusions, findings, and recommendations or management action plans. Findings are usually described with the elements of condition, criteria, cause, effect, and recommendation.
The follow-up stage makes sure the recommendations are actually carried out. Audit management software such as Audithink can help with audit planning, work program templates, notifications, follow-up monitoring, and automated reports.
See also:
- Audit Report: Definition, Functions, Types, & Examples
- Audit Finding Follow-Up: Causes of Overlooked Issues and Their Solutions
What Are the Stages of External Audit?
An external Audit is an independent evaluation performed by a third-party auditor to assess the fairness of an organization's financial statements.
This Audit aims to provide confidence to stakeholders that the financial statements are presented reasonably and in accordance with applicable accounting standards. Here are the stages of external audit:
Before initial planning begins, there is an engagement acceptance stage. The auditor at a Public Accounting Firm first assesses whether the audit engagement is appropriate to accept, based on the client's background and the availability of team resources. The full explanation of this stage is in the Client Acceptance section of the article on audit planning.
1. Early Planning
Initial planning is an important step in external auditing to understand the client's business and Environment and establish an audit strategy.
- Understand the client's business and Environment: The Auditor collects information about the client's business, industry and external environment to identify relevant risks.
- Assessing Audit Risk: Based on Business understanding, the auditor assesses the risk of material misstatement in the financial statements and establishes an appropriate audit strategy.
2. Testing and evaluation of Internal controls
The Auditor assesses the design and effectiveness of the client's internal controls to determine the level of substantive testing required.
- Assessing Internal Control Design: The Auditor assesses whether internal controls are properly designed to prevent and detect errors or fraud.
- Control Testing: The auditor performs control tests to make sure that internal controls operate as designed.
3. Substantive Testing
Substantive testing is performed to verify the fairness of account balances and transactions listed in the financial statements.
- Testing Details: Auditors conduct detailed testing of account balances and transactions to verify the fairness and accuracy of the data.
- Analytical Procedure: Auditors use analytical procedures to assess the overall fairness of financial statements and identify anomalies or unusual trends.
4. Audit Reporting
The final stage in the external audit is the preparation of an audit report containing the auditor's opinion on the fairness of the financial statements.
- Prepare Audit Report: The audit report presents the auditor's opinion on whether the financial statements are presented reasonably, in all material respects, in accordance with applicable accounting standards.
- Discussion Of Audit Results: The Auditor discusses with management and the audit Committee the findings and recommendations and provides necessary clarifications.
The external audit stages above can be mapped to the IAPI Audit Standards (SA) as follows.
| Stage | Relevant IAPI Audit Standards |
|---|---|
| Early planning | SA 300 (Revised 2021) Planning an Audit of Financial Statements and SA 315 (Revised 2021) Identifying and Assessing the Risks of Material Misstatement |
| Testing and evaluating internal control | SA 330 The Auditor's Responses to Assessed Risks (control tests) and SA 265 for communicating internal control deficiencies |
| Substantive testing | SA 330 (substantive procedures) and SA 500 Audit Evidence |
| Audit reporting | SA 700 Forming an Opinion and Reporting on Financial Statements |
The 2021 revision of the Audit Standards has been effective since 1 January 2022. Numbers and editions can change, so check the Audit Standards page on the IAPI website (information as of October 2026).
What Is the Difference Between Internal and External Audit Stages?
| Aspect | Internal audit | External Audit |
|---|---|---|
| Executor | The audit team inside the organization | An independent auditor from a Public Accounting Firm |
| Purpose | Assess internal control, risk management, and governance | Giving an opinion on the fairness of the financial statements |
| Reference standard | GIAS 2024 | Audit Standards (SA) of IAPI |
| Main stages | Planning, fieldwork, reporting, and follow-up | Initial planning, control testing, substantive testing, and reporting |
| End result | An audit results report with findings and recommendations | An auditor's report containing an opinion |
See also:
What Are the Stages of Management Audit?
A management audit assesses the quality of how an organization is managed: whether management's functions, strategy, structure, and decision making support the organization's goals. Its object is the way the organization is run, for example the marketing, production, finance, or human resources function, rather than one specific program. The following are the stages of a management audit:
What Is the Theoretical Basis and Literature of Management Audit?
In the literature, management audit is also known as operational audit. The terminology dictionary Medical Subject Headings (MeSH) of the US National Library of Medicine defines it as a management review designed to evaluate efficiency and identify areas that need management improvement. Sukrisno Agoes (2012) defines it as an examination of a company's operating activities, including the accounting policies and operating policies set by management (cited in Anawati and Ngumar, 2016).
According to Bayangkara (2008), the objectives of a management audit are:
- Assessing the performance of management and the various functions within the company.
- Assessing whether resources (people, equipment, and other assets) have been used efficiently and economically.
- Assessing whether the company can achieve the objectives it has set.
- Giving recommendations to top management to fix weaknesses in how management and operating procedures are applied, in order to improve the efficiency, economy, and effectiveness of operations.
The same literature records two formulations of the stages, namely according to Leo (cited in Agoes, 2008) and Bayangkara (2011):
| Reference | Management audit stages |
|---|---|
| Leo (cited in Agoes, 2008) | Preliminary audit, review and testing of the management control system, detailed examination, and report development |
| Bayangkara (2011) | Preliminary audit, review of the management control system, further audit, reporting, and follow-up |
The four stages in this article are a simplification of that framework: planning covers the preliminary audit, fieldwork covers the review of management controls and detailed examination, while evaluation, reporting, and follow-up cover report development and monitoring of improvements.
References:
- Anawati, L., and Ngumar, S. (2016). Audit Manajemen untuk Mengevaluasi Efektivitas dan Efisiensi Rekrutmen Sumber Daya Manusia (Management Audit to Evaluate the Effectiveness and Efficiency of Human Resource Recruitment). Jurnal Ilmu dan Riset Akuntansi, 5(1).
- National Library of Medicine. MeSH: Management Audit (D008330).
The quotations from Agoes, Bayangkara, and Leo above are taken from that journal article (a secondary source). For formal references, check the original books, for example Auditing by Sukrisno Agoes and Audit Manajemen: Prosedur dan Implementasi by Bayangkara.
1. Planning
The auditor starts by understanding the organization and deciding which part of its management will be assessed.
- Determining the function to assess: the auditor selects a management function that is risky or considered less effective, for example strategic planning, organizational structure, or human resources management.
- Setting criteria: the organization's goals, internal policies and procedures, and common industry practices become the benchmarks for the assessment.
2. Implementation
The auditor traces how management decisions are made and carried out.
- Reviewing management documents: the strategic plan, organizational structure, job descriptions, operating procedures, and minutes of management meetings.
- Interviews and observation: the auditor talks with leaders and staff to understand actual practice, then compares it with the documents available.
3. Evaluation
The auditor compares actual conditions with the criteria and looks for the causes of gaps.
- Identifying strengths and weaknesses in management, for example overlapping responsibilities, policies that are not followed, or decisions that are not documented.
- Tracing the root cause of each weakness so that recommendations address the source of the problem, not just its symptoms.
4. Reporting
A management audit report is intended to improve how the organization is managed.
- Preparing a report containing findings, causes, and recommendations to improve management, delivered to the leaders with authority to decide.
- Discussing the draft with management, then monitoring whether the agreed improvements are actually carried out.
What Are the Stages of Performance Audit?
Performance Audit aims to assess the effectiveness, efficiency, and economy of an organization's programs or activities.
Under Law 15/2004 Article 4 paragraph 3, a performance audit of state financial management consists of an examination of the economy and efficiency aspects and an examination of the effectiveness aspect. The following are the stages of a performance audit:
1. Planning
The auditor selects the program or activity to assess and sets what the audit aims to answer.
- Formulating the audit questions: for example whether the program reaches its targets and whether resources are used economically.
- Developing criteria and indicators for three aspects: economy (input costs), efficiency (the relationship between inputs and outputs), and effectiveness (achievement of goals or outcomes).
2. Implementation
The auditor collects quantitative and qualitative data on how the program is running.
- Collecting data on budget realization, output achieved, cost per unit of output, and the results experienced by beneficiaries.
- Comparing achievements with program targets, previous periods, or similar programs as benchmarks.
3. Evaluation
The auditor assesses each aspect separately, then looks for the causes of results that fall short.
- Assessing the economy, efficiency, and effectiveness aspects one by one against the indicators that have been set.
- Identifying the causes of shortfalls, for example weak planning, implementation that does not follow the design, or constraints beyond the program manager's control.
4. Reporting
A performance audit report contains an assessment of each aspect and recommendations that can be measured.
- Preparing a report that presents findings for each aspect along with recommendations that have success indicators.
- Delivering the report to program managers and policymakers, then monitoring the follow-up.
What Is the Difference Between a Management Audit and a Performance Audit?
| Aspect | Management audit | Performance Audit |
|---|---|---|
| Object | The functions, strategy, and resource management of the organization's management | A specific program or activity within the organization |
| Main measure | Management effectiveness and efficiency | Economy, efficiency, and effectiveness of the program |
| Product | Recommendations to improve how the organization is managed | Recommendations to improve program performance |
See also:
- Management Audit: Definition, 7 Objects, Functions, and Implementation
- Performance Audit: Definition, Implementation, and Examples
What Standards Guide Each Audit Stage?
GIAS 2024 consists of 5 domains and 15 principles. The internal audit stages in this article fall under Domain V, Performing Internal Audit Services, specifically Principles 13, 14, and 15 (principle titles from the official IIA website).
| Standards | Applies to | Notes |
|---|---|---|
| GIAS 2024 from The IIA | Internal audit | Effective since 9 January 2025 |
| Audit Standards (SA) of IAPI | External audit of financial statements | The 2021 revision has been effective since 1 January 2022 |
See also:
- Internal Audit Standards in Indonesia and Guidelines for Their Implementation
- Regulations Internal Audit Software Must Meet in Indonesia
FAQ About Audit Stages
What are the stages of an internal audit?
Four stages: planning (setting the objectives, scope, and audit program based on risk analysis), execution (gathering evidence and performing compliance and substantive testing), reporting (compiling findings and recommendations then discussing them with management), and follow-up (monitoring implementation of recommendations, with a re-audit if needed). Before all four, there is usually an engagement acceptance stage that assesses client eligibility.
What is the audit acceptance stage?
The audit acceptance stage (client acceptance) is the step before formal planning, in which the auditor, especially at a Public Accounting Firm, assesses whether the audit engagement is appropriate to accept based on the client's background, the availability of resources, and communication with the previous auditor if there is one. This stage is covered in detail in the audit planning article.
What are the stages of an external audit?
Four stages: initial planning to understand the business and assess audit risk, testing and evaluating the client's internal controls, substantive testing of account balances and transactions including analytical procedures, then reporting containing the auditor's opinion on the fairness of the financial statements.
What is the difference between an internal audit and an external audit?
Internal audit is carried out by a team inside the organization to ensure compliance and operational efficiency. External audit is carried out by a third party, namely an independent auditor from a Public Accounting Firm, to give an opinion on the fairness of the financial statements, so stakeholders gain assurance over those statements.
What is the difference between compliance testing and substantive testing?
Compliance testing is done to ensure policies and procedures are followed correctly and internal controls operate as designed. Substantive testing is done to verify the fairness of account balances and transactions listed in the financial statements.
What are the stages of a management audit?
Four stages: planning (determining the management function to assess and the assessment criteria), fieldwork (reviewing management documents, interviews, and observation), evaluation (comparing conditions with the criteria and tracing the root causes of weaknesses), then reporting along with follow-up monitoring.
What are the stages of a performance audit?
Four stages: planning (formulating audit questions and indicators for economy, efficiency, and effectiveness), fieldwork (collecting data on realization, output, and cost), evaluation (assessing each aspect and finding the causes of shortfalls), then reporting with measurable recommendations. Under Law 15/2004 Article 4, a performance audit covers the economy and efficiency aspects as well as the effectiveness aspect.
What standards are used in the audit stages?
Internal audit follows the 2024 Global Internal Audit Standards (GIAS) from The IIA, effective 9 January 2025. External audit of financial statements follows the Audit Standards (SA) of IAPI, including SA 300, 315, 330, 500, and 700. The mapping is in the tables in this article.
What documents are produced at each stage of an internal audit?
Planning produces the annual audit plan and the audit work program, fieldwork produces working papers and audit evidence, reporting produces the audit results report, and follow-up produces the action plan matrix and the results of verifying the improvements.
Through an understanding of the stages of internal, external, management, and performance audits, organizations can ensure that their audit processes run efficiently and effectively.
A properly conducted Audit not only helps in identifying problems and risks, but also provides recommendations that can improve the organization's performance and compliance.
By following the correct audit steps, you can ensure that your audit provides significant added value to your organization.
If you need detailed information about the audit application, consult directly with Audithink team.
