Most internal audit work dies in the follow-up. The fieldwork gets done, the observations get written, the report goes to the audit committee, and then four months pass and nobody can say which actions were actually closed.
Audcrix runs the whole cycle — acceptance to closure retest — against the client's own books.
It starts by deciding whether it applies at all
Before any scoping, the module reaches a section 138 verdict: is internal audit required for this entity. Alongside it, a section 144 independence check, because the firm doing the internal audit may be barred from it by the other services it already provides.
Scoping then reads the processes the books say exist rather than a generic checklist, with an overlay for the nature of the business. A trading company and a manufacturer do not have the same processes, and the ledgers already know which one this client is.
The risk-control matrix, then one paper per control
Planning produces the risk-control matrix. Fieldwork turns it into one working paper per control, with the programme organised per process, each paper holding its sample, its notes and its documents.
Controls are tested on the client's own books — the synced ledgers and vouchers — rather than on a copy somebody exported and emailed.
Exceptions go to the person who owns the process
A control's exceptions can be sent to the process owner, not just written into a report nobody opens. There is a live issue log, and when management says an issue is fixed, there is a closure retest rather than a tick.
Management replies in the client portal
Observations reach management through the client portal, and management's updates come back the same way. Follow-up carries automatic reminders and escalation, which is the part that normally depends on somebody remembering to chase.
The engagement around the fieldwork
The lifecycle is held too: the engagement letter, plan approval, risk scores, meetings, and the period reports that move draft to discussed to final — frozen once final. There is an audit committee pack at the end of it.
Why the freeze and the retest matter
A period report that can be edited after it was discussed is not evidence of anything. A closed action that was never retested is a management assertion, not a finding. Those two rules are what separate an internal audit file that survives review from a folder of documents.
Questions CAs ask
Does it check whether internal audit is required at all?
Yes. Scoping begins with a section 138 verdict on whether internal audit applies to the entity, together with a section 144 independence check on whether the firm can take it on given its other services.
How is the scope decided?
From the processes the books say exist, with an overlay for the nature of the business, rather than from a generic checklist that treats a trader and a manufacturer alike.
How is fieldwork organised?
The risk-control matrix becomes one working paper per control, with the programme arranged per process and each paper holding its sample, notes and documents. Controls are tested on the client's own synced books.
What happens to an exception once it is raised?
It can be sent to the process owner, tracked in a live issue log, and closed only through a closure retest rather than on management's word that it is fixed.
How does management respond?
Through the client portal. Observations go out that way and management's updates come back the same way, with automatic reminders and escalation on the follow-up.
Can a period report be changed after it is final?
No. Period reports move from draft to discussed to final and are frozen once final, so a report that was discussed cannot be quietly rewritten afterwards.
Related modules
- Fraud Detection — Forensic checks across every Tally voucher — duplicate payments, negative cash, Benford anomalies, back-dated postings — with convergence and honest gap flags.
- Accounting Checks — Completeness, cut-off, accrual and classification checks run over the whole Tally books — every verdict showing its basis, every finding exportable as a working paper.
- Statutory Audit — Statutory audit software built around the Standards on Auditing — materiality, SA 530 sampling, SA 510 opening balances and confirmations, documented as the work is done.