Many internal audits involve the repetitive review of the same topical areas, if only because these areas are perceived to have the highest degree of financial risk to a company, and so are worthy of constant review. When internal audits are repeated on a regular basis, the managers of these audits will usually pull out the workpapers from the last audit that was conducted on the same area, and simply copy out the same auditing requirements. This can result in over-auditing, because the internal audit manager never questions why each of the tasks needs to be completed a second time. Many of the audit procedures noted in the workpapers may have been intended to be one-time reviews to investigate perceived problems that have since been overcome with new control systems, rendering the original audit steps no longer valid. Given this constant tendency to copy previous audits, a non-essential audit step may have been repeated dozens of times, simply on the grounds that if it was done before, it should be done again.
A better approach is to conduct a brief, formal review of the upcoming internal audit with the internal audit team assigned to do the work. This group should review the results of the last internal audit, pore over the control chart (if any) for the area to be reviewed, and come up with a new audit plan for every engagement. By doing so, the team avoids the mindless repetition of early audit steps that are no longer valid, and concentrates on the key issues that will result in the most valuable audit results. Also, by including the entire audit team in this review, a company will find that there is much better buy-in to and understanding of the work being done, which may increase both employee efficiency and reduce long-term turnover in the internal audit staff.