A internal audit testing is a list of things to check and a number of days to check them in, and the second is decided by the first long before anyone opens the list. For a business holding its systems to a control framework, the checks run over the controls, the tests, the vulnerabilities, the incidents and the access reviews; every item is a sample to take, minutes to spend and a chance of a gap that costs hours to close. The compliance officer who works those figures before the audit is scoped budgets the audit and its aftermath together; the one who does not learns the aftermath's cost from the invoice. This page walks what a internal audit testing covers, how to size its days, its expected gaps and its all-in cost, and where the free sheets on this site do that sizing from the program's own numbers, with no account.
Testing, as a program
Regulatory compliance testing is the scheduled proof that controls operate: a test per control at a frequency, with a failure rate and a remediation cost. The IT control-testing sheet on this site works a year of it, 480 tests and $19,720 on the worked example, and the paid plan keeps every test's result against its control.
Gaps, remediation and the all-in cost
An audit finds gaps at a rate the last audit already measured, and every gap costs remediation hours. The audit sheets on this site for HIPAA, GDPR and PCI, and the IT control-testing sheet for a framework, take the item count, the gap rate, the hours per gap and the hourly cost and return the gaps expected, the remediation hours and the cost with the aftermath in it. For IT compliance the sheet to start with is the IT control-testing sheet. None of them publishes a benchmark rate; each works the program's own.
Internal audit plans, and the internal audit methodology behind them
A plan is a schedule of what will be audited over a period and why, and the why is the methodology: how areas were ranked, what evidence each engagement will seek, how samples are sized, how findings are rated and how follow up happens. A plan without it is a calendar, and it produces the audit that visits the same three areas every year because they are the ones somebody knows how to audit. In a small program the methodology can be two pages, and it has to be written down, because the standard test of independence is whether somebody else following the same method would have reached the same rating.
What to do with the number
Take it to the budget conversation and to the consultant's proposal. A proposal whose audit days land far from the sheet's is sampling more or less than the program needs, and a budget that covers the assessment and not the remediation is half a budget. The guide this page supports covers the questions for a regulatory compliance consultant. Attestvio Pro keeps every audit with its findings and their remediation against the obligations it tested; the sheets stay free.
What a internal audit testing covers
For a business holding its systems to a control framework: the controls, the tests, the vulnerabilities, the incidents and the access reviews. Each is a control with evidence behind it, and a checklist is the list of controls with a sample size and a minutes-per-sample figure attached whether or not anyone wrote them down. The audit scope sheet on this site takes systems, controls, samples and minutes and returns the samples, the hours, the days and the coverage the days available give, so the checklist has a size before it has a date.
External audit vs internal audit: who the report is for
An external audit is performed for somebody outside the organization, and its report is that reader's assurance rather than management's improvement list. An internal audit is performed for the organization's own board or its equivalent, and its value is the finding nobody outside would have raised. The consequences are practical: an external auditor's scope is set by what its reader needs to rely on and cannot be negotiated for convenience, while an internal plan is set by where the organization thinks its risk is. Programs that treat the second as a rehearsal for the first get neither.
Questions people ask about internal audit testing
How long does a internal audit testing take?
Items times minutes over 60 for the hours, over the hours in an audit day for the days: the audit scope sheet on this site works it from your own systems, controls, samples and minutes with no account, and publishes no benchmark.
What does a internal audit testing cost all in?
Assessment hours plus the expected gaps times the remediation hours per gap, times the hourly cost. The audit sheets on this site work it from your own gap rate; the worked examples run from $8,800 to $19,720 for the sizes entered.
Does Attestvio run the internal audit testing?
No. Attestvio sizes it and keeps the findings and their remediation against the obligations; the audit itself is your assessor's or your own team's. The sheets are free either way.
Internal vs external audit: can one team do both?
Not on the same subject. Whoever built or runs a control cannot provide independent assurance about it, and the external reader's reliance depends on that independence. A small organization solves it by keeping the internal function on areas the external scope does not reach, or by borrowing a reviewer from outside the team for the areas it does.