How to Prepare for an Internal Audit: A Four-Week Plan

An internal audit is not a test of how likeable the team is. It is a test of whether the organisation can demonstrate what it says it does. Preparation is therefore not about polishing the office for a visit — it is about making sure the evidence exists, matches, and can be found quickly.

Four weeks is enough for most small and mid-sized organisations, if the work is structured.

This is practical preparation guidance. Audit standards, client requirements, and regulatory frameworks differ. Follow the specific standard that applies to your organisation and take qualified advice where needed.

Week 1: Scope, criteria, and owners

Day 1–2: Confirm what is being audited.

Get the audit plan, the standard being applied, the period under review, and the departments included — in writing. Write down the names of the people who will be interviewed.

Day 2–3: Collect the criteria.

The auditor assesses you against something: a standard, a client contract, a company procedure, or a regulation. Collect those documents and confirm that you are working from the current version. Auditing against a superseded procedure wastes everyone’s day.

Day 3–5: Assign owners by area.

Area	Typical owner
HR and personnel files	HR officer
Payroll and statutory contributions	Accounts or HR
Procurement and vendor files	Admin or procurement
Safety and facilities	Safety officer or site supervisor
Contracts and licensing	Compliance or legal
Records and document control	The person who owns the filing system

One owner per area, named in writing. Shared ownership means nobody is responsible.

Week 2: Document readiness

Build the evidence pack. For each requirement, produce the document and a one-line note saying where the evidence is.

Run the four tests on every document type:

1. Existence — is it there for everyone it should cover?
2. Completeness — signatures, dates, amounts, and approvals present?
3. Consistency — do registers, payroll, and contracts agree?
4. Currency — is the version current, and are renewals valid?

Then fix what is straightforward: missing signatures, missing dates, outdated versions, undated policies, missing acknowledgements. Anything that cannot be fixed within a day goes on the open-items register with an owner and a date.

A practical tip that saves audits: create an index page. One sheet listing: requirement, document, location, owner. Auditors follow indexes instead of rummaging through folders, and the audit moves much faster.

Week 3: Mock audit and staff briefing

Run a mock interview. Take the audit checklist and ask a colleague to question the area owners as an auditor would. Common questions include:

• Show me how a new employee’s file is completed from joining date.
• How do you know this register is complete for March?
• What happens when a decision is made verbally? Where is it recorded?
• How do you know this version of the policy is the current one?
• Who approves overtime, and where is the approval recorded?

The point is not to memorise answers. It is to discover the requirements where no real evidence exists yet.

Brief the team. Thirty minutes, everyone, four messages:

1. Answer what you know; say “I will confirm and come back” for what you do not.
2. Do not guess, and never claim a document exists without checking.
3. Keep normal work running; the audit is not a holiday.
4. If something is wrong, say so plainly. Auditors write findings about systems, and hiding a gap makes it worse.

Prepare the room and the files. Book a room, arrange access to the files, keep a printer and a scanner available, and make sure the person who can pull records is at work that day.

Week 4: Final checks and the audit-day routine

Final checks:

• Confirm the audit schedule, times, and participants.
• Reconcile the open-items register and finish the achievable items.
• Put a copy of the current policies and procedures in one place.
• Make sure everyone knows who the contact person is for document requests.

On audit day:

• Start on time, with the right people in the room.
• Open with a short, factual briefing: what the organisation does, the structure, and the scope. No marketing presentation.
• Give the auditor a workspace and a named contact who can fetch documents quickly.
• Record every request in a log, along with who provided it and when. This prevents “we never got that” at the closing meeting.
• Take notes of findings as they are raised. Clarify factual errors politely and immediately — two days later is harder.
• Hold a daily wrap-up with the team: what was asked, what was found, what needs follow-up.

During the closing meeting

• Listen fully before responding.
• Correct factual misunderstandings with evidence, not argument.
• Do not promise corrective action on the spot if you have not agreed it internally. Ask for the written report first.
• Agree the follow-up date and the format for evidence submission.

After the audit

Write a corrective action plan within one week. For each finding: root cause, action, owner, target date, and evidence to be submitted. Then track it in a meeting that actually happens — the same risk register approach works well.

Close the loop by verifying the fix: not “we have updated the procedure” but “the updated procedure has been applied in the last five files, and here is the evidence”.

The preparation mistakes that cost the most

1. Discovering the standard on audit day. Read it in week one.
2. Finding documents that disagree with each other. Consistency is what auditors test first.
3. Keeping two versions of a policy live. Date and archive superseded versions.
4. Nobody available to answer questions. The person who handles the files should be present.
5. Arguing with findings in the closing meeting. Correct the facts, then work on the plan.
6. No follow-up. Findings that are never closed become repeat findings, and repeat findings carry more weight than the original ones.

Where to start

Take the free 10-point compliance audit checklist, complete it once for your own organisation, and you will already know which two or three areas need attention before the auditor arrives.

Related reading

• How I Run a Basic HR Compliance Check in a Nepali Company
• Compliance Risk Register: How to Track Risks in a Simple Excel Sheet
• HR Documentation Checklist: The Records Every Employer Should Keep