The internal audit work program (often abbreviated PKA), also known as audit program or audit work program, is an operational guide that ensures the audit process follows standards and produces accurate, accountable findings.
With a structured internal audit work program, a company can evaluate performance, assess compliance with established standards, and identify areas needing improvement.
The main purpose of an internal audit work program is to ensure the engagement objectives are achieved in a directed and documented way, so that audit results add value and drive business process improvement, helping the company run more efficiently, transparently, and accountably.
This article covers the definition, types, benefits, how to prepare, and examples of internal audit work programs, including a sample inventory audit work program table. As of 14 October 2026, the standards reference is the Global Internal Audit Standards (GIAS) 2024 from The IIA, effective since 9 January 2025 and replacing the 2017 IPPF standards. In GIAS, this document is called the engagement work program (Standard 13.6).
What is Internal Audit work Program?
An internal audit work program is a document or plan containing the systematic steps that internal auditors must take when carrying out an audit assignment. The program covers the audit objectives and scope, evaluation criteria, procedures and testing methodology, assigned auditors, and the work schedule.
In other words, an internal audit work program is an operational guide that ensures the audit process runs according to standard and produces accurate, accountable findings. In English-language internal audit literature, this document is known as an audit work program.
The work Program is compiled based on the results of the risk assessment and focuses on areas that have a significant influence on the achievement of the company's goals.
With a risk-based approach, internal audit work programs can help organizations allocate audit resources more effectively and efficiently.
What Is the Difference Between an Audit Program and a Planning Document (Audit Plan)?
The two are often confused. The planning document (audit plan) sets out what is audited, when, and with what resources. At the organization level, the internal audit plan is prepared by the chief audit executive based on a risk assessment conducted at least annually (Standard 9.4 of GIAS 2024). Audit program breaks one engagement from that plan down into detailed procedural steps carried out by auditors in the field, and is called the engagement work program in Standard 13.6. This article covers the work program at that engagement level, not the annual audit plan. How to prepare an audit plan is covered in the article 8 steps to preparing an audit plan.
What Does the Global Internal Audit Standards 2024 Say About the Work Program?
The work program is governed by Standard 13.6 (Domain V, Principle 13: Plan Engagements Effectively). Its main provisions are as follows.
- Internal auditors must develop and document an engagement work program to achieve the engagement objectives.
- The work program must be based on information obtained during engagement planning, including the results of the engagement risk assessment if available (Standard 13.2).
- The work program must identify the criteria for evaluating each objective, the tasks to achieve the objectives, the methodology (including analytical procedures) and tools used, and the internal auditors assigned to each piece of work.
- Chief audit executive must review and approve the work program before it is carried out, and promptly approve any changes afterwards.
Standard 13.6 builds on other standards in the same principle: engagement objectives and scope (13.3), evaluation criteria (13.4), and engagement resources (13.5). That planning work is recorded in audit working papers (Standard 14.6). If auditors use sampling, GIAS recommends that the work program state the sampling methodology, population, sample size, and whether the results can be projected to the population. Source: Global Internal Audit Standards 2024 (Indonesian translation from The IIA).
What Are the Components of an Engagement Work Program?
GIAS does not set a fixed format. From the requirements above, a good engagement work program contains at least the following components. Standard 13.6 also recommends columns for the name of the person performing the work, the completion date, and review and approval marks for each task.
| Components | What is recorded | GIAS 2024 reference |
|---|---|---|
| Objectives and scope | The results to be achieved, plus the boundaries of the objects, locations, processes, and period audited | Standard 13.3 |
| Key risks and controls | Risks from the engagement risk assessment and the controls to be tested | Standard 13.2 |
| Evaluation criteria | Benchmarks for assessing each objective, for example SOPs, regulations, or contracts | Standard 13.4 |
| Tasks and methodology | Procedural steps, analytical procedures, tools, and sampling methods if used | Standard 13.6 |
| Performers and schedule | The auditor carrying out each task, deadlines, and resources needed | Standards 13.5 and 13.6 |
| Review and approval | Completion date, review marks, and approval by the chief audit executive before the program is carried out | Standard 13.6 |
| Working paper reference | Working paper numbers containing the evidence and test results | Standard 14.6 |
What Is the Function and Role of the Audit Work Program in an Organization?
The internal audit work Program has several important functions in supporting audit success and overall organizational performance, including:
- As a guide to the audit
Work Program provides a clear direction for auditor in carrying out their duties, starting from the planning stage to reporting audit results. - Improve audit consistency and quality
With documented and systematic procedures, auditors can ensure that each audit is conducted to a consistent and professional standard. - Help with risk management
Audit work programs help organizations identify and assess risks that may impact business objectives, as well as provide recommendations for mitigation. - Drive compliance and efficiency
Through a structured audit, organizations can ensure that policies, procedures, and regulations have been implemented correctly and efficiently. - Provide added value
Internal audit work programs not only focus on finding errors, but also provide insights for Process Improvement and increased operational efficiency.
By consistently running the internal audit work program, the company can build a strong supervision system, increase transparency, and create a work culture that is accountable and oriented to continuous improvement.
What Are the Types of Audit Programs?
Audit program types vary and are adjusted to the object being audited. Below are seven commonly used groupings of audit programs. These groupings are practical, based on the object audited, and are not a fixed classification in GIAS; every program still contains the same components as discussed above.
1. Compliance Audit Program
The program for a compliance audit is designed to ensure the company complies with applicable standards, regulations, and internal policies. It covers:
- List of regulations or standards to comply with
- Compliance verification procedure
- Proof of compliance
- Findings of non-compliance
- Corrective action plan
2. Financial Audit Program
The program for financial audit is used to examine the company's financial statements. Its procedures verify:
- Truth of financial statements
- Account balance accuracy
- Transaction completeness
- Validity of supporting evidence
3. Operational Audit Program
An operational audit program measures whether the operational process of the company run effectively, efficiently, and economically. It covers:
- SOP and workflow evaluation
- Process efficiency measurement
- Benchmarking against KPIs or industry standards
- Analysis of the causes of inefficiency
- Operational improvement recommendations
4. Information Systems Audit Program
The program for Information Systems audit serves as a guide for assessing the company's information technology (IT) systems and digital controls. It covers:
- Cyber security evaluation
- Access control
- System log check
- Data integrity testing
- Assessment of specific applications (FMS, ERP, HRIS, etc.)
5. Risk Management Audit Program
The program for risk management audit used to assess whether the company's risk management process is running effectively, with testing focused on high-risk areas. Its contents include:
- Identify high risk areas
- Assessment of innate risk and control risk
- Determination of more specific audit procedures
- Testing plans in crucial areas
6. General Audit Program
The program for general audit serves as the standard guide for the entire audit process, from planning to reporting. It covers:
- Audit planning procedure
- Internal control procedures
- Substantive testing procedures
- Documentation of findings and preparation of reports
7. Area Specific Audit Program
A specific-area audit program is designed to examine one area in detail, such as inventory, cash, sales, HR, or purchasing. It covers:
- Audit objectives tailored to the audit area
- Control testing procedure
- Substantive testing procedures for each area
- Relevant evidence
What Are the Benefits (Advantages) of the Internal Audit Work Program?
The internal audit work program does not only serve as a technical guide for the auditor, but also bring a variety of strategic benefits to the organization as a whole.
With proper implementation, the internal audit work program can be an effective tool in strengthening governance and supporting the achievement of business goals. Here are some of the main benefits of an internal audit program.
1. Improving Transparency and Accountability
Internal audit work programs play an important role in improving transparency and accountability at all levels of the organization.
With a structured audit program, the company can ensure that each department and business unit operates in accordance with established protocols and standards.
A systematic audit process helps uncover inappropriate or suboptimal practices, thus creating a culture of honesty and openness.
Through comprehensive and objective reporting of audit results, senior management and stakeholders get a clear picture of the actual condition of the company, including strengths and weaknesses in the internal control system.
This transparency is very valuable for strategic and operational decision-making. In addition, a well-planned audit work program allows the company to prove to external parties, such as regulators, investors, and business partners, that the organization is managed with integrity and accountability.
2. Identify risks and ensure compliance with regulations
One of the biggest benefits of an internal audit program is its ability to identify potential risks before they develop into serious problems.
Audit teams working on a structured work program can systematically conduct risk assessments, analyze vulnerable areas, and provide early warning of weaknesses in control systems.
This process allows companies to develop mitigation strategies that are proactive rather than reactive.
In the context of regulatory compliance, the internal audit work program ensures that the company always follows the applicable rules and regulations, both internal and external.
A well-planned compliance Audit can identify gaps in regulatory implementation, evaluate the effectiveness of existing compliance controls, and help organizations avoid serious consequences of non-compliance, such as sanctions, fines, or reputational damage.
In an increasingly complex and stringent regulatory environment, internal audit work programs are an important instrument for companies to stay on track.
3. Improve operational efficiency and effectiveness
A well-planned internal audit work Program allows an in-depth evaluation of the efficiency and effectiveness of business processes.
Through observation, data analysis, and control testing, internal auditors can identify operational inefficiencies, duplication of work, or non-optimal use of resources.
These findings form the basis for streamlining processes, removing bureaucratic barriers, and improving overall productivity.
An operational Audit as part of a work program can evaluate whether existing systems and processes have achieved their set goals in the most efficient way.
Auditors can identify opportunities for automation, standardization, or restructuring of processes that can result in significant cost savings or improved quality of Service.
Thus, the internal audit work program focuses not only on control and compliance, but also on value creation and improving operational performance.
4. Provide recommendations for continuous improvement
The main plus of the internal audit work program lies in its recommendations for continuous improvement.
Internal audit does not stop at reporting findings. According to Standard 14.4 of GIAS 2024, internal auditors prepare recommendations or agree on improvement plans with management to address the causes of findings and mitigate risks to an acceptable level.
Audit recommendations resulting from a comprehensive work program can be a catalyst for positive transformation in the organization.
An internal audit team, with in-depth knowledge of a company's operations, can offer unique perspectives and valuable insights to improve processes, reduce risk, and optimize performance.
These recommendations often include industry best practices, proven effective frameworks, or innovative approaches that can improve a company's competitiveness.
In addition, a continuous audit work program allows monitoring the implementation of recommendations and evaluating their impact, creating a continuous cycle of improvement and encouraging a culture of excellence in the organization.
What Are the Stages in Preparing an Internal Audit Work Program?
The following four stages show where the work program sits in one engagement cycle: made during planning, used during execution, then results are reported and followed up. The full audit cycle, including how it differs from external audit, is covered in the guide to audit stages. The steps for preparing the program itself are in the next section.
1. Audit Planning
This initial stage is the foundation of the entire audit. At the planning stage, the auditor identifies the areas or processes to be audited based on the level of risk, strategic importance, and needs of the organization.
The engagement work program is prepared by internal auditors. According to Standard 13.6 of GIAS 2024, the chief audit executive (in many organizations in Indonesia held by the head of the Internal Control Unit or SPI) must review and approve it before the audit begins, including any later changes.
Auditors also set the audit objectives, scope, and audit methods, and determine the time and resource allocation needed. The result of this stage is a risk-based audit plan (Standard 9.4 of GIAS 2024) and a detailed engagement work program for each audit carried out (Standard 13.6).
See also: The importance of Audit planning and its steps in the examination
2. Audit Implementation
After the planning is completed, the next stage is the implementation of the audit. Here, auditors begin to collect data and information through observation, interviews, document checks, and testing of applicable systems and procedures.
The Auditor evaluates the extent to which the audited activities are in compliance with applicable policies, regulations, and standards. Implementation is carried out with the principles of objectivity and professionalism to ensure audit results can be trusted.
3. Reporting Of Audit Results
After the audit is completed, the auditor prepares a comprehensive audit report. This report contains a summary of audit findings, root cause analysis, potential impacts, and recommendations for improvement.
The format of the report must be clear, concise, and objective so that it is easily understood by management. Prior to finalization, the draft report is usually discussed with the audited party to ensure factual accuracy and obtain a response to the audit findings.
The final report is then distributed to interested parties.
The format, components, and examples of reports are covered in full in the article audit report. In this article, reporting is seen only as the stage that closes the work program.
4. Follow-up and Evaluation
The final stage is follow-up and evaluation, in which the auditor monitors the implementation of the recommendations agreed with management.
The purpose of this stage is to ensure that corrective actions have been carried out on schedule and are effective in resolving the problems found. According to Standard 15.2 of GIAS 2024, internal auditors must confirm that management has implemented the recommendations or improvement plans, by asking about implementation progress, performing risk-based follow-up assessments, and updating the status of actions in the tracking system.
The Auditor also conducts an evaluation of the entire audit process to identify areas of improvement in the audit methodology and approach.
The results of this evaluation are then used as input for the planning of the next audit, thus creating a continuous improvement cycle in the internal audit function.
How Do You Prepare and Carry Out an Audit Program?
Preparing an audit program requires an understanding of the company's business and operational processes. The steps are as follows.
- Determine the purpose of the audit - what should be achieved in the audit process
- Determine the scope of the audit - what are the limitations of the examination
- Risk identification - know which areas are at risk of misstatement or potential violations
- Set evaluation criteria: benchmarks for assessing each objective, for example SOPs, regulations, or contracts
- Define audit procedures - define what steps the auditor should take in the audit process
- Specify the required evidence and documents - identification of information and documents that can support the audit process
- Arrange audit schedule - define audit periods, deadlines for each procedure, and tasks of each member
- Define team and person in charge - form a team and share the tasks of each member
- Request review and approval: chief audit executive reviews and approves the work program before it is carried out, as well as any changes to it (Standard 13.6)
Once the audit program is prepared, auditors carry it out while continuing to follow it as their guide:
- Carry out audit procedures according to plan - implementation of the audit can be done in accordance with the audit program that has been prepared
- Collect audit evidence - collect audit evidence that is relevant and supports the examination, such as documents, screenshots, photographs, interviews, or written confirmations
- Perform internal control tests - check if the SOP has been applied correctly
- Record audit findings in KKA - document all steps, evidence, and audit findings in the working papers (KKA) (audit working papers) that have been prepared, so that other auditors can repeat the work with the same result (Standard 14.6)
- Discuss the findings with the relevant division - the auditor Submits Preliminary findings and requests clarification from the relevant division
- Draw up an action plan with management - the auditor follows up the findings by drawing up an action plan so that similar problems do not recur
- Arrange audit report - the auditor prepares a complete report, both results, findings, evidence, and recommendations for improvement
What Are Examples of Internal Audit Work Program Implementation?
Implementation of internal audit work programs will differ in each type of organization according to business characteristics, specific risks, and stakeholder needs.
Here are some concrete examples of the implementation of internal audit work programs in various industrial sectors that can be a reference in the development of an effective audit program.
1. Examples in manufacturing companies
Audit compliance with Work Safety Standards
The Occupational Safety Compliance audit Program in manufacturing companies includes a thorough evaluation of the implementation of Occupational Safety and health (K3) procedures.
Auditors usually check K3 policy documentation, completeness of personal protective equipment, availability of safety equipment, and implementation of Occupational Safety Training.
The Audit also includes an examination of the incident reporting system, the handling of emergencies, as well as compliance with industry standards such as ISO 45001 or national occupational safety regulations.
These audit findings are critical to preventing workplace accidents and ensuring a safe working environment for all employees.
See also: What is Smk3 Audit? Definition, Purpose, Types & Implementation Procedures
Audit Of Efficiency Of Raw Material Use
In the context of raw material efficiency, the audit program will focus on the evaluation of production processes to identify potential waste and optimization opportunities. The Auditor conducts an analysis of the ratio of raw material consumption, the level of defective products, inventory management, and production waste management.
Audit methods include direct observation of the production process, analysis of historical data, and interviews with production personnel. The results of this audit can provide concrete recommendations to reduce waste of raw materials, minimize production waste, and increase the company's overall profit margin.
2. Examples in financial institutions
Audit compliance with financial regulations
The compliance audit Program at financial institutions is designed to ensure that organizations meet all applicable regulations such as anti-money laundering (APU), know your customer (KYC) principles, and consumer protection.
Auditors examine internal policies and procedures, test samples of financial transactions, and evaluate suspicious transaction monitoring systems.
The scope of the audit also includes verification of mandatory reporting to regulators, compliance with credit limits, and the implementation of good corporate governance.
The findings of this compliance audit are crucial to avoid regulatory sanctions and maintain the reputation of financial institutions.
Information System Security Audit
In the digital era, the information system security audit program at financial institutions includes a comprehensive evaluation of IT infrastructure, identity and access management, customer data security, and disaster recovery plans.
The Auditor performs penetration testing, system vulnerability analysis, and evaluation of physical and logical security controls.
The Audit also includes an assessment of the management of security incidents, compliance with security standards such as ISO 27001, and the effectiveness of security awareness training for employees.
The results of these audits help financial institutions identify security gaps and strengthen defenses against evolving cyber threats.
3. Examples in technology companies
Data management and privacy Audit
The data management audit Program in technology companies focuses on evaluating user personal data protection policies and practices.
The auditor checks whether data management practices comply with regulations such as Law No. 27 of 2022 on Personal Data Protection (and the GDPR if the service reaches users in the European Union), user consent mechanisms, and procedures for handling data access requests.
The Audit also includes evaluation of data retention policies, encryption of sensitive data, and management of third-party access to data. These audit findings are critical to ensuring compliance with privacy regulations and building user trust in technology platforms.
IT project governance Audit
The IT project governance audit Program evaluates the effectiveness of software development processes, change management, and it Resource Management.
The Auditor conducts an examination of the project documentation, the development methodology used, project risk management, and Budget Control.
The Audit also includes an evaluation of the process quality assurance, configuration management, and compliance with software development standards.
The results of IT project governance audits help technology companies identify bottlenecks in product development and improve the efficiency of the software development cycle.
4. Example of an Inventory Area Audit Work Program in Table Form
Here is an example audit program for the inventory area at a fictitious company, PT Abadi Jaya.
- Audit objective: ensure the existence and completeness of inventory and assess the fairness of inventory recording and valuation.
- Scope: central warehouse, inventory card, document of receipt and expenditure of goods, inventory report of the end of the period.
- Audit procedure: study the warehouse management SOP, check if the stock in and out is recorded in real-time, compare physical results with inventory cards, and fill out workpaper checklists according to procedures.
- Deadline: 7-11 December 2026
- Responsible Person: Dwi Santoso (main auditor) and Abdul Karim (Assistant auditor)
The table below turns the example above into an engagement work program that auditors can fill in. The performer and working paper reference columns follow the recommendations of Standards 13.6 and 14.6.
| No | Tasks and procedures | Method and evidence | Executor | KKA ref. |
|---|---|---|---|---|
| 1 | Study the warehouse management SOP and the flow of goods receipt and issue | Interview the warehouse head, copy of the SOP | Dwi Santoso | P-1 |
| 2 | Observe the physical inventory count (stocktaking) at the central warehouse | Physical count record, photos, list of items tested | Dwi Santoso and Abdul Karim | P-2 |
| 3 | Compare the physical count results with the inventory cards and the period-end inventory report | Reconciliation of differences and inventory cards | Abdul Karim | P-3 |
| 4 | Test the cut-off (cut-off) of goods receipt and issue documents around period end | Document sample; sampling method, population, and sample size recorded | Abdul Karim | P-4 |
| 5 | Check whether stock in and out is recorded on time | Comparison of document dates with recording dates in the system | Dwi Santoso | P-5 |
| 6 | Assess the reasonableness of inventory valuation, for example obsolete or slow-moving items | Inventory aging list and provisioning policy | Dwi Santoso | P-6 |
| 7 | Record differences as potential findings and discuss them with the warehouse head | Summary of findings and auditee responses | Dwi Santoso | P-7 |
This example is fictitious and needs to be adapted to the results of the engagement risk assessment, the company's inventory policy, and the applicable accounting standards. Before it is carried out, this program is reviewed and approved by the chief audit executive. With the work program templates in Audithink, a task list like this can be saved and reused for the next engagement.
FAQ About Internal Audit Work Programs
What is an internal audit work program?
The internal audit work program (PKA), or audit work program in English, is a document or plan containing the systematic steps that internal auditors must take when carrying out an audit assignment, covering objectives and scope, evaluation criteria, procedures and methodology, and the assigned auditors. GIAS 2024 calls it the engagement work program (Standard 13.6).
Who prepares the internal audit work program?
Prepared by internal auditors at the engagement planning stage, then reviewed and approved by the chief audit executive (in many organizations held by the head of the Internal Control Unit or SPI) before the audit is carried out, in line with Standard 13.6 of GIAS 2024.
How is an internal audit work program prepared?
Prepared based on the results of a risk assessment and focused on areas that significantly affect the achievement of company objectives. At the engagement level, its basis is information from engagement planning, including the engagement risk assessment (Standards 13.2 and 13.6 of GIAS 2024). With a risk-based approach, audit resources can be allocated more effectively and efficiently.
What is the function of an audit work program in an organization?
Serving as a guide for audit execution from planning to reporting, improving audit consistency and quality, supporting risk management, encouraging compliance and efficiency, and providing added value through new for process improvement.
What are the benefits of an internal audit work program for a company?
Four main benefits: increasing transparency and accountability across all levels of the organization, identifying risks while ensuring regulatory compliance, improving operational efficiency and effectiveness, and producing recommendations for continuous improvement.
What are the stages of preparing an internal audit work program?
Four stages: audit planning that sets the areas, objectives, scope, and resources; audit execution through observation, interviews, and testing; reporting of audit results with root cause analysis and recommendations; then follow-up and evaluation of how those recommendations are implemented.
What do implementation examples look like across sectors?
In manufacturing companies, compliance audits against work safety standards referring to ISO 45001 and audits of raw material usage efficiency. In financial institutions, compliance audits against regulations such as anti-money laundering (AML), know-your-customer (KYC) principles, and consumer protection.
Is an audit program the same as an internal audit work program?
Yes. An audit program, an internal audit work program (PKA), and an audit work program all refer to the same document: the detailed procedural steps an auditor carries out in a single audit engagement.
What are the types of audit programs?
Seven practical groupings: compliance audit program, financial audit, operational audit, information systems audit, risk management audit, general audit, and audit programs for specific areas such as inventory, cash, sales, HR, and purchasing.
What is the difference between an audit program and an audit plan?
An audit plan sets the audit areas, schedule, and resources. An audit program details the procedural steps the auditor carries out to execute that plan.
How do you prepare an audit program?
Set the audit objectives, define the scope, identify risk areas, set evaluation criteria, determine audit procedures, define the evidence and documents needed, prepare a schedule with deadlines for each procedure, form the team and assign those responsible, then request review and approval from the chief audit executive before the program is carried out.
What is the difference between an annual audit work program and an engagement work program?
The internal audit plan (often understood as the annual audit work program) is prepared by the chief audit executive based on an organization-level risk assessment conducted at least annually, and contains the list of engagements and their resources (Standard 9.4 of GIAS 2024). The engagement work program is made for a single engagement and contains the criteria, tasks, methodology, and assigned auditors (Standard 13.6).
Which standard governs the internal audit work program?
As of 14 October 2026, the work program is governed by Standard 13.6 of the Global Internal Audit Standards (GIAS) 2024 from The IIA, effective since 9 January 2025. This standard requires the engagement work program to be documented and approved by the chief audit executive before it is carried out.
Conclusion
The internal audit work Program has a very important role in strengthening corporate governance.
With proper preparation and implementation, this work program can assist organizations in ensuring compliance with regulations, improving operational efficiency, and creating transparency and accountability in every line of business.
The implementation of an effective internal audit work program allows the company to proactively identify risks, take appropriate corrective measures, and encourage continuous improvement.
This not only supports the achievement of short-term goals, but also builds a solid foundation for long-term growth and business sustainability.
Therefore, every organization should start developing and strengthening their internal audit practices.
With a commitment to professional and structured auditing, the company can create a reliable supervision system and increase competitiveness amid the challenges of a changing business world.
After understanding the importance of the internal audit work program and seeing various examples of its implementation, it's time to take concrete steps to improve the audit function in your organization.
Audithink helps internal audit teams prepare and run audit work programs through risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automatic reports.
Want to see how Audithink helps your team prepare and run internal audit programs? Schedule a application demo with us.
Have questions about audithink implementation? Contact our team immediately!
