How does a compliance officer conduct an internal compliance audit?

• Step 1. Scoping and Planning , where the compliance officer defines the audit objectives, scope (e.g., financial, operational, or data privacy), timeline, and regulatory frameworks involved (like HIPAA, GDPR, or SOX).
• Step 2. Risk Assessment , identifying key compliance risks, high-risk areas, and past audit findings or regulatory changes to prioritize where resources are spent.
• Step 3. Information Gathering and Review , collecting relevant policies, procedures, past reports, training records, and system logs to establish the baseline of what should be happening.
• Step 4. Testing and Fieldwork , executing substantive and controls testing through employee interviews, process walkthroughs, physical inspections, and sampling transactions to see if day-to-day practices match documented policies.
• Step 5. Evaluating Findings , analyzing gaps, control failures, or non-compliance instances, and rating them by severity (e.g., low, medium, high risk).
• Step 6. Reporting , drafting a comprehensive audit report detailing the methodology, executive summary, specific findings, and root causes for senior management and the board.
• Step 7. Remediation and Follow-up , collaborating with department heads to build a corrective action plan (CAP) and tracking those fixes until full resolution is achieved.

Would you like me to focus on a specific industry (like healthcare, finance, or tech) or provide a template for the corrective action plan?

An internal compliance audit is a structured, evidence-based review to determine whether an organization is meeting applicable laws, regulations, contractual obligations, industry standards, and its own policies—and whether its controls actually work in practice. A good audit is risk-based, independent, documented, and followed through to remediation. ISO 19011:2026 emphasizes risk-based and evidence-based auditing, independence, due care, confidentiality, and fair presentation.

Typical internal compliance audit process

1. Define the audit objective and scope

The compliance officer first establishes:

• What is being audited—for example, anti-bribery, privacy, AML, workplace safety, sanctions, HIPAA, or procurement.
• Why it is being audited—routine assurance, a regulatory requirement, a prior finding, a whistleblower allegation, or a change in risk.
• Which locations, departments, systems, transactions, and third parties are included.
• The audit period.
• The criteria against which compliance will be assessed.

For example:

Objective: Determine whether the company's third-party due-diligence process complies with its anti-bribery policy and applicable requirements. The scope should be specific enough that someone reviewing the audit later can understand exactly what was tested.

2. Perform a risk assessment

The officer identifies the areas most likely to have significant compliance failures and prioritizes them.

Typical considerations include:

• Regulatory exposure
• Financial or operational impact
• History of violations
• Complaints or whistleblower reports
• Changes in law or business operations
• High-risk countries or customers
• High-risk third parties
• Previous audit findings
• Weaknesses in existing controls

This is why compliance audits shouldn't simply check every policy equally. Higher-risk areas generally receive deeper or more frequent testing. DOJ guidance similarly emphasizes risk-based auditing, periodic testing, and whether the company adjusts its compliance program as risks change.

3. Establish the audit criteria and control matrix

The compliance officer maps each requirement to the control intended to satisfy it.

A simple matrix might look like:

This step turns a broad question—"Are we compliant?"—into testable questions.

4. Prepare an audit plan and evidence request

Before fieldwork, the officer determines:

• Auditors and responsibilities
• Interviewees
• Sampling methodology
• Systems and records to review
• Testing procedures
• Timeline
• Reporting process
• Confidentiality requirements

An evidence request might include policies, training records, transaction data, approvals, contracts, investigation files, monitoring reports, access logs, certifications, and previous audit results.

5. Conduct interviews and walkthroughs

The auditor speaks with people who operate the controls rather than relying exclusively on written policies.

For example:

"Walk me through what happens when a business unit wants to hire a new third party." The auditor follows the process from beginning to end and compares what employees say happens with what the policy says should happen and what the records demonstrate actually happened.

Interviews can also identify "workarounds" that aren't obvious from documentation.

6. Test the controls

This is the heart of the audit.

The officer determines whether controls are:

1. Designed appropriately — would the control address the identified risk if followed?
2. Implemented — is the control actually being used?
3. Operating effectively — does it consistently produce the intended result?

Testing can involve:

• Document inspection
• Transaction sampling
• Re-performance
• System testing
• Data analytics
• Observation
• Employee interviews
• Third-party interviews
• Exception testing

For example, rather than simply confirming that a gift-and-entertainment policy exists, the auditor might select 50 transactions and determine whether required approvals were obtained before the expenditure.

DOJ guidance specifically considers whether companies conduct periodic audits, test controls, analyze compliance data, interview employees or third parties, and use the results to improve their programs.

7. Document exceptions and determine root causes

A finding should be supported by evidence—not merely an auditor's opinion.

A useful finding structure is:

Condition: What actually happened?

Criteria: What should have happened?

Cause: Why did the problem occur?

Risk/impact: What could happen as a result?

Recommendation: What should management do?

For example:

Finding: 8 of 50 sampled high-risk vendors lacked documented compliance approval before onboarding. Criteria: Company policy requires Compliance approval before onboarding. Cause: The procurement system does not prevent onboarding when the approval field is incomplete. Risk: Vendors may be engaged without required due diligence. Recommendation: Implement a system control preventing onboarding until required approval is recorded. Root-cause analysis is particularly important because fixing individual exceptions without addressing the underlying process can allow the problem to recur. DOJ guidance specifically looks at whether companies conduct meaningful root-cause analysis and remediate underlying misconduct.

8. Rate and prioritize findings

Findings are typically categorized according to severity, such as:

• Critical/high — significant regulatory, legal, financial, or reputational exposure
• Medium — meaningful control weakness requiring corrective action
• Low — limited deficiency or process improvement

The exact rating methodology should be defined before or independently of the results where possible.

The auditor should distinguish between:

• Control design failures
• Control execution failures
• Isolated exceptions
• Systemic failures
• Potential misconduct

A potential allegation of intentional misconduct may require a separate investigation rather than being handled as an ordinary audit finding.

9. Discuss findings with management

Before issuing the final report, the compliance officer normally gives responsible management an opportunity to:

• Validate factual accuracy
• Provide additional evidence
• Explain circumstances
• Agree or disagree with findings
• Propose corrective actions

This is important because an apparent exception may have a legitimate explanation or additional evidence that the auditor didn't initially receive.

10. Issue the audit report

A typical report contains:

• Executive summary
• Objective and scope
• Methodology
• Applicable criteria
• Overall conclusion
• Key findings
• Risk ratings
• Supporting evidence
• Management responses
• Corrective-action owners
• Target completion dates

The most important question isn't simply "How many findings were there?" but:

Does the evidence demonstrate that the compliance controls are reasonably designed and operating effectively? That distinction is central to modern compliance-program evaluation. DOJ's framework asks, among other things, whether a program is well designed, effectively implemented and actually works in practice.

11. Track remediation

The audit isn't finished when the report is issued.

Each finding should have:

• A responsible owner
• Corrective action
• Due date
• Priority
• Required evidence of completion
• Validation procedure

For example:

Finding → Implement automated approval control → Compliance/IT owner → 60 days → Auditor tests 25 subsequent transactions.

12. Perform follow-up testing

The compliance officer then determines whether remediation actually worked.

Simply receiving a memo saying "policy updated" isn't enough. The auditor may need to retest transactions or observe the new process.

This creates the cycle:

Risk assessment → audit → findings → remediation → retesting → updated risk assessment

That continuous-improvement cycle is an important characteristic of an effective compliance program.

A practical audit checklist

A compliance officer can think of the process as:

1. Scope → 2. Risk assess → 3. Map requirements → 4. Identify controls → 5. Request evidence → 6. Interview → 7. Sample/test → 8. Document exceptions → 9. Root-cause analysis → 10. Report → 11. Remediate → 12. Retest

The key principle is don't audit whether paperwork exists; audit whether the compliance system actually prevents or detects the risk it was designed to address.

For a U.S. corporate compliance program, the current DOJ materials are also useful because they specifically address periodic testing, internal audit, data analysis, reporting mechanisms, investigations, and remediation.

If you're learning this for a compliance officer interview, certification, or an actual audit, I can also give you a realistic end-to-end sample audit (including audit plan, testing procedures, evidence request list, findings, and final report).

A typical report contains:

• Executive summary
• Objective and scope
• Methodology
• Applicable criteria
• Overall conclusion
• Key findings
• Risk ratings
• Supporting evidence
• Management responses
• Corrective-action owners
• Target completion dates

The most important question isn't simply "How many findings were there?" but:

Does the evidence demonstrate that the compliance controls are reasonably designed and operating effectively? That distinction is central to modern compliance-program evaluation. DOJ's framework asks, among other things, whether a program is well designed, effectively implemented and actually works in practice.

11. Track remediation

The audit isn't finished when the report is issued.

Each finding should have:

Conducting an internal compliance audit requires a systematic approach to evaluate whether an organization's policies, procedures, and operations align with laws, regulations, and internal standards.

Here is how a compliance officer typically executes this process:

1. Scoping and Planning

• Risk Assessment: Identify and prioritize high-risk areas based on past violations, regulatory changes, or business expansions.
• Audit Objectives: Define the specific scope, goals, and boundaries of the audit (e.g., focusing solely on data privacy or financial controls).
• Timeline and Resources: Establish a schedule and assign responsibilities to the audit team.

1. Preparation and Information Gathering

• Regulatory Review: Compile the relevant laws, industry standards, and internal corporate policies that apply to the scoped area.
• Documentation Request: Gather existing policies, previous audit reports, training records, and workflow diagrams from relevant departments.
• Checklist Creation: Develop tailored testing scripts and checklists based on regulatory requirements.

1. Fieldwork and Testing

• Employee Interviews: Interview key personnel and process owners to understand daily operations versus written policies.
• Document Testing: Examine a random sample of transactions, contracts, logs, or communications to verify operational compliance.
• Observation: Directly observe processes (like physical security controls or data handling procedures) to test real-world execution.

1. Analysis and Findings Evaluation

• Defect Identification: Compare the operational reality against the compliance standard to spot gaps, control failures, or policy violations.
• Root Cause Analysis: Determine why a failure occurred (e.g., lack of training, outdated software, or intentional bypassing of controls) rather than just noting the symptom.
• Severity Assessment: Classify findings by risk level—low, medium, or high/critical—based on potential legal or financial impact.

1. Reporting and Recommendations

• Draft Report: Write a clear, objective audit report detailing the scope, methodology, specific findings, and associated risks.
• Actionable Recommendations: Provide practical, prioritized remediation steps for management to fix identified gaps.
• Management Response: Meet with department heads to review findings and obtain their formal commitments and timelines for corrective action.

1. Follow-Up and Remediation Monitoring

• Corrective Action Plan (CAP): Track the implementation of agreed-upon fixes by department owners.
• Verification Testing: Conduct follow-up testing after a set period to ensure deficiencies have been successfully resolved.
• Board Reporting: Summarize audit outcomes, systemic risks, and remediation progress for executive leadership or the board of directors.

Would you like me to focus on a specific industry (like healthcare, finance, or tech) or provide a template for a risk assessment matrix to help structure your audit?

An internal compliance audit is essentially a structured, evidence-based check that the organization is meeting its legal, regulatory, contractual, and internal-policy requirements—and that its controls actually work in practice. A good audit is risk-based rather than simply checking every policy line by line.

Typical internal compliance audit process

What makes an audit effective?

A strong compliance audit should answer three questions:

1. Are the right controls designed to address the organization's compliance risks?
2. Are employees actually following those controls?
3. Can the organization demonstrate with evidence that the controls work?

This aligns closely with the U.S. Department of Justice's framework for evaluating corporate compliance programs: whether the program is well designed, adequately resourced and implemented in good faith, and actually works in practice.

Simple example

Suppose a company wants to audit its anti-bribery compliance program.

The compliance officer might:

• Identify applicable anti-bribery laws and company policies.
• Assess high-risk countries, agents, and transactions.
• Select 50 third parties and 100 payments for testing.
• Review due-diligence files.
• Check approval records.
• Examine gifts, entertainment, commissions, and charitable payments.
• Interview sales and procurement employees.
• Analyze payment data for unusual patterns.
• Identify exceptions.
• Rate the findings by risk.
• Agree on corrective actions with management.
• Report significant issues to senior management or the board.
• Re-test after remediation.

The important distinction is that an internal compliance audit isn't simply "checking whether policies exist." It tests whether the organization has appropriate controls and whether those controls operate effectively in the real world.

A compliance officer conducting an internal compliance audit is essentially testing whether the organization is following the laws, regulations, policies, procedures, and controls that apply to its operations—and whether those controls actually work in practice.

A good audit is risk-based and evidence-based, rather than simply checking whether policies exist. ISO 19011:2026, for example, emphasizes independence, evidence-based auditing, and a risk-based approach.

1. Define the audit scope

First, the compliance officer determines:

• What is being audited
• Why it is being audited
• Which laws, regulations, standards, contracts, and internal policies apply
• Which departments, locations, systems, transactions, or third parties are included
• The audit period
• The level of risk involved

For example, an audit might focus specifically on:

“Whether the company’s third-party due-diligence process complies with applicable anti-bribery requirements and company policy.” The scope should be specific enough to produce meaningful findings.

2. Perform a risk assessment

The officer identifies the areas most likely to present compliance problems and prioritizes them.

Typical risk factors include:

• Regulatory requirements
• History of violations or complaints
• High-risk transactions
• High-risk countries or customers
• Third-party relationships
• Previous audit findings
• Changes in regulations or business operations
• Weak or manual controls
• Employee turnover
• Whistleblower allegations

This is important because an effective compliance program should be tailored to the organization's particular risks rather than being a generic "paper program." The DOJ, for example, specifically looks at whether a compliance program is designed around the company's actual risk profile and whether it is periodically tested.

3. Establish the audit criteria

The compliance officer identifies the requirements against which the organization will be tested.

These might come from:

• Federal or state laws
• Industry regulations
• Regulatory guidance
• Licensing requirements
• Contractual obligations
• ISO or other standards
• Corporate policies
• Standard operating procedures
• Internal controls

The officer then turns those requirements into audit questions or test procedures.

For example:

4. Prepare the audit plan and checklist

The officer determines:

• Who will perform the audit
• Who will be interviewed
• What documents and data are needed
• What samples will be tested
• Which locations or business units will be visited
• Audit dates and milestones
• How findings will be classified

Auditor independence is important. Someone should not ordinarily be responsible for auditing controls they personally designed or operate if that creates a conflict of interest.

ISO 19011 identifies independence, integrity, due professional care, confidentiality, evidence-based auditing, and risk-based auditing as core auditing principles.

5. Gather evidence

This is where the audit becomes more than a paperwork review.

The compliance officer may:

• Review policies and procedures
• Examine contracts and transaction records
• Sample invoices and payments
• Review employee training records
• Examine approval logs
• Test system controls
• Review monitoring reports
• Interview employees
• Observe processes
• Analyze compliance data
• Review complaints and investigations
• Examine third-party files

The key question is:

"Show me evidence that this control actually operated."

For example, a policy may say that every high-risk vendor must undergo enhanced due diligence.

The auditor doesn't stop at confirming that the policy exists. They might select 30 high-risk vendors and determine:

1. Was each vendor properly classified?
2. Was due diligence performed?
3. Was it completed before engagement?
4. Was the required approval obtained?
5. Were red flags identified?
6. Were those red flags appropriately resolved?
7. Was the documentation retained?

6. Interview employees

Interviews are particularly useful for discovering the difference between what the policy says and what actually happens.

Questions might include:

• "Walk me through what happens when you onboard a new vendor."
• "Who approves this transaction?"
• "What happens if you identify a red flag?"
• "Where do you document that?"
• "What would you do if your manager asked you to bypass this control?"
• "Have you ever seen this process handled differently?"

The auditor compares interview responses with documentary and system evidence.

7. Test the controls

The officer determines whether controls are actually operating effectively.

There are generally two important questions:

Design effectiveness: Would the control, if followed, reasonably prevent or detect the compliance risk?

Operating effectiveness: Is the control actually being performed consistently and correctly?

For example:

Policy: Payments over $25,000 require approval from the CFO. A design test asks whether requiring CFO approval is an appropriate control.

An operating test might select 50 payments over $25,000 and verify that the required approval actually occurred.

This type of control testing and analysis is specifically emphasized in the DOJ's current approach to evaluating corporate compliance programs.

8. Document exceptions and findings

When the auditor identifies a problem, they should document the evidence carefully.

A strong finding normally identifies:

Criteria → Condition → Cause → Effect/Risk → Recommendation

For example:

Criteria: Company policy requires enhanced due diligence before onboarding high-risk vendors.

Condition: 4 of 25 sampled high-risk vendors lacked documented enhanced due diligence before onboarding.

Cause: The vendor-management system does not prevent onboarding when the required review is incomplete.

Risk: The company could engage vendors without completing required compliance screening.

Recommendation: Implement a system control preventing activation of high-risk vendors until required approvals are completed. This is much stronger than simply saying, "Vendor due diligence needs improvement."

9. Determine the root cause

A good compliance audit doesn't just identify symptoms.

The auditor asks why the problem occurred.

For example:

Finding: Employees didn't complete required training.

Possible root causes:

• Employees weren't notified.
• The training system didn't generate reminders.
• Managers weren't held accountable.
• The training wasn't relevant to employees' roles.
• The compliance department couldn't monitor completion.
• Employees could access systems despite missing mandatory training.

The appropriate remediation depends on the root cause.

10. Discuss findings with management

Before issuing the final report, the compliance officer normally gives responsible management an opportunity to:

• Clarify facts
• Provide additional evidence
• Correct factual errors
• Explain mitigating circumstances
• Agree or disagree with findings
• Propose corrective actions

This is sometimes called an exit meeting or closing meeting. ISO 19011 includes conducting audit activities and preparing/distributing the audit report as part of the audit process.

11. Issue the audit report

A typical report contains:

1. Executive summary
2. Audit objectives
3. Scope and methodology
4. Applicable requirements
5. Findings
6. Risk ratings
7. Root causes
8. Recommendations
9. Management responses
10. Corrective-action owners
11. Target completion dates

Findings may be categorized, for example, as:

• Critical
• High
• Moderate
• Low
• Observation

The exact classification system depends on the organization.

12. Track corrective actions

This is one of the most important parts.

An audit isn't finished merely because the report was issued.

The compliance officer should maintain a remediation tracker showing:

13. Verify remediation

Once management says the problem is fixed, the compliance officer should obtain evidence and retest the control.

For example:

Management says the vendor onboarding system now blocks high-risk vendors without approval. The auditor should test the system and verify that it actually does so.

Only then should the finding be closed.

This "test → remediate → retest → close" cycle is fundamental to an effective audit program. The DOJ likewise looks at whether companies test their compliance programs and whether identified weaknesses result in meaningful remediation.

The entire process in simple terms

Risk assessment → Scope → Criteria → Audit plan → Evidence gathering → Interviews/testing → Findings → Root cause → Report → Corrective action → Retesting → Closure

The most important mindset is:

Don't audit whether the company has a policy. Audit whether the company is actually complying with the requirement and whether its controls can reliably detect or prevent violations. For a mature compliance function, the audit should ultimately answer three questions:

1. Is the compliance program appropriately designed?
2. Is it adequately implemented and supported?
3. Does it actually work in practice?

Those three questions closely mirror the framework the U.S. Department of Justice uses when evaluating corporate compliance programs.

If you're learning this for a compliance officer job/interview, I can also give you a realistic internal compliance audit example from start to finish, including the audit plan, checklist, sample testing, findings, and final report.

13. Verify remediation

Once management says the problem is fixed, the compliance officer should obtain evidence and retest the control.

For example:

Management says the vendor onboarding system now blocks high-risk vendors without approval. The auditor should test the system and verify that it actually does so.

Only then should the finding be closed.

This "test → remediate → retest → close" cycle is fundamental to an effective audit program. The DOJ likewise looks at whether companies test their compliance programs and whether identified weaknesses result in meaningful remediation.

The entire process in simple terms

Risk assessment → Scope → Criteria → Audit plan → Evidence gathering → Interviews/testing → Findings → Root cause → Report → Corrective action → Retesting → Closure

The most important mindset is:

Don't audit whether the company has a policy. Audit whether the company is actually complying with the requirement and whether its controls can reliably detect or prevent violations. For a mature compliance function, the audit should ultimately answer three questions:

12. Track corrective actions

This is one of the most important parts.

An audit isn't finished merely because the report was issued.

The compliance officer should maintain a remediation tracker showing:

13. Verify remediation

Once management says the problem is fixed, the compliance officer should obtain evidence and retest the control.

For example:

Management says the vendor onboarding system now blocks high-risk vendors without approval. The auditor should test the system and verify that it actually does so.

Only then should the finding be closed.

A compliance officer conducts an internal compliance audit by systematically planning, executing, analyzing, and reporting on an organization’s adherence to external laws and internal policies.

Watch this detailed overview on how to effectively perform a compliance audit and minimize regulatory exposure:

01:02:47 How To Perform a Compliance Audit 4.5K views  · 3 years ago YouTube · TCN

1. Preparation and Scoping

• Define Objectives: Establish what specific regulations, frameworks, or internal controls the audit will target.
• Determine Scope: Select the business units, timeframes, and processes under evaluation.
• Build a Checklist: Create customized testing procedures and criteria based on current legal standards and company policies.

2. Execution and Data Collection

• Gather Documentation: Request relevant policies, logs, transaction records, and training records.
• Conduct Interviews: Speak directly with process owners and key personnel to understand operational workflows and internal controls.
• Perform Testing: Test sample transactions or system controls to see if actual practice matches documented requirements.

3. Analysis and Evaluation

• Identify Gaps: Compare findings against regulatory thresholds or expected control behaviors to locate non-compliance or vulnerabilities.
• Assess Risk: Evaluate the severity and potential legal, financial, or reputational impact of any identified deficiencies.

4. Reporting and Corrective Action

• Draft the Final Report: Document findings clearly—often following standard audit criteria like the five Cs (Condition, Cause, Effect, Criteria, and Corrective Action).
• Create Remediation Plans: Collaborate with department heads to design actionable corrective action plans that address root causes and close compliance gaps.

If you'd like, let me know:

• What industry or regulation (e.g., healthcare, finance, data privacy) you are focusing on
• Whether you need a sample audit checklist or risk assessment framework

I can tailor the next steps directly to your compliance program.

An internal compliance audit is a structured review to determine whether an organization is following applicable laws, regulations, policies, contractual requirements, and its own controls. A good audit is risk-based rather than simply a checklist exercise. The Institute of Internal Auditors (IIA) describes internal auditing as involving planning, performing engagement work, developing findings/conclusions, communicating results, and monitoring action plans.

Typical process

1. Define the audit objective and scope

The compliance officer first determines:

• What is being audited — e.g., AML, privacy, workplace safety, vendor compliance, financial controls.
• Why it is being audited — regulatory requirement, annual plan, management concern, prior finding, incident, etc.
• Which period will be examined.
• Which departments, locations, systems, transactions, and employees are included.
• Which requirements will serve as the audit criteria.

For example:

Objective: Determine whether the company complies with its customer due-diligence requirements. Scope: Customer onboarding transactions from January–June 2026. Criteria: Applicable regulations + company AML policy + documented procedures. The IIA recommends understanding the area, performing a preliminary risk assessment, establishing objectives and scope, allocating resources, and documenting the audit plan.

2. Identify the compliance requirements

The auditor creates a requirements/control matrix mapping each requirement to the organization's control.

This is often the most important preparation step because it establishes what "compliant" actually means.

3. Assess risk

Not every requirement deserves equal audit attention.

The compliance officer considers factors such as:

• Regulatory consequences
• Financial impact
• Likelihood of noncompliance
• Previous violations
• Complaints or incidents
• Changes in regulations or processes
• Volume and complexity of transactions
• Effectiveness of existing controls

Higher-risk areas receive more extensive testing. The IIA's current guidance specifically emphasizes risk-based audit planning to focus resources on an organization's most significant risks.

4. Develop the audit work program

The officer translates the scope into specific procedures.

For example:

1. Obtain the current compliance policy.
2. Verify that required employees completed training.
3. Select a representative sample of 50 transactions.
4. Check whether required approvals were obtained.
5. Review exceptions.
6. Interview process owners.
7. Compare actual practices with written procedures.
8. Document supporting evidence.

5. Gather evidence

Evidence can come from:

• Policies and procedures
• Contracts
• Training records
• System reports
• Emails and approvals
• Transaction records
• Access logs
• Regulatory filings
• Interviews
• Physical inspections
• Screenshots or system evidence

The auditor should obtain sufficient, reliable, and relevant evidence rather than relying solely on management's assertions. Internal audit guidance describes conducting engagement work to develop findings and conclusions.

6. Test the controls

This is where the auditor determines whether controls actually work.

There are two related questions:

Design effectiveness:

If the control operates as written, would it adequately address the compliance risk? Operating effectiveness:

Did the control actually operate consistently during the audit period? For example, a company may have a policy requiring two approvals for payments over $10,000. The auditor might sample 30 payments over $10,000 and verify whether both approvals actually occurred.

7. Document exceptions and determine findings

When the auditor finds a problem, it should be supported by evidence and clearly distinguish between:

• Requirement: What should have happened?
• Condition: What actually happened?
• Cause: Why did the problem occur?
• Effect/risk: What could result?
• Recommendation: What should management do?

Example:

Requirement: All employees handling personal data must complete annual privacy training. Condition: 12 of 100 sampled employees had not completed the required training. Cause: The training system did not automatically escalate overdue assignments. Risk: Employees may handle personal information without required training, increasing regulatory and privacy risk. Recommendation: Implement automated escalation and monthly compliance reporting.

8. Discuss preliminary findings with management

Before issuing the final report, the compliance officer normally discusses findings with the responsible business owners.

This gives management an opportunity to:

• Correct factual errors.
• Provide additional evidence.
• Explain the root cause.
• Agree or disagree with the finding.
• Propose corrective action.

This isn't about allowing management to eliminate unfavorable findings; it's about ensuring the final audit record is accurate and fair.

9. Issue the audit report

A typical report contains:

• Executive summary
• Objective and scope
• Methodology
• Overall conclusion
• Key findings
• Risk ratings
• Root causes
• Recommendations/corrective actions
• Responsible owners
• Target completion dates

The IIA's current standards specifically address communicating engagement results and monitoring action plans, and its recent guidance emphasizes effective communication of findings and conclusions.

10. Track corrective actions

The audit isn't really finished when the report is issued.

The compliance officer records each remediation item and tracks:

Importantly, the officer should verify effectiveness, not merely accept a statement that something was fixed. Follow-up monitoring is an established part of the internal audit cycle.

In simple terms

The process can be remembered as:

Plan → Identify requirements → Assess risk → Test → Gather evidence → Identify gaps → Report → Remediate → Verify

A strong compliance audit therefore isn't simply "Do we have the right policies?" It asks:

What requirement applies? → What control addresses it? → Does the control exist? → Does it actually operate? → What evidence proves that? → If it failed, what is the risk and how will it be fixed? The applicable regulatory framework will determine the specific requirements and testing methodology—for example, an AML audit will look very different from a HIPAA, SOX, environmental, or workplace-safety audit. The IIA's 2024 Global Internal Audit Standards became effective January 9, 2025 and provide the current professional framework for internal audit work.

If you'd like, I can also give you a practical internal compliance audit checklist/template that a compliance officer could use from planning through the final report.

Conducting an internal compliance audit requires a structured, methodical approach to ensure an organization adheres to external laws, regulations, and internal policies. A compliance officer typically follows a phased lifecycle to execute this effectively:

1. Preparation and Scoping
   • Define Scope: Determine the specific departments, processes, locations, or regulations (e.g., GDPR, HIPAA, OSHA) the audit will cover.
   • Assemble the Team: Assign qualified internal auditors or secure external resources, ensuring independence and objectivity (auditors should not audit their own work).
   • Review Past Findings: Analyze previous audit reports, open issues, and historical risk assessments to identify recurring problem areas.
2. Risk Assessment and Planning
   • Identify Risks: Evaluate the inherent risks within the targeted areas (e.g., financial fraud, data privacy breaches).
   • Develop Audit Program: Create a detailed audit plan outlining the objectives, methodology, testing procedures, timelines, and resources needed.
   • Determine Criteria: Establish the baseline standards, laws, or company policies against which performance will be measured.
3. Fieldwork and Information Gathering
   • Review Documentation: Examine policies, procedures, past training records, contracts, and previous transaction logs.
   • Conduct Interviews: Speak with key personnel and process owners to understand daily operations and gauge compliance awareness.
   • Perform Testing: Test controls through sampling (e.g., verifying whether a sample of employee hires completed mandatory background checks).
4. Analysis and Evaluation
   • Evaluate Deficiencies: Compare observed practices against the compliance criteria to identify gaps, weaknesses, or outright violations.
   • Determine Root Causes: Investigate why a failure occurred (e.g., lack of training, outdated technology, or intentional circumvention) rather than just noting the symptom.
   • Rate Severity: Categorize findings by risk level (e.g., low, medium, high, critical) based on potential legal, financial, or reputational impact.
5. Reporting and Communication
   • Draft the Audit Report: Write a clear, objective summary detailing the audit scope, methodology, significant findings, and identified risk exposures.
   • Management Response: Collaborate with process owners to obtain their feedback and secure agreed-upon corrective action plans (CAPs) with assigned accountability and deadlines.
   • Present to Stakeholders: Deliver the final report to senior management, the board of directors, or the audit committee.
6. Follow-up and Remediation Monitoring
   • Track Progress: Monitor the implementation of the corrective action plans according to the agreed-upon timeline.
   • Verify Closure: Conduct follow-up reviews or testing to ensure identified deficiencies have been fully remediated and new controls are operating effectively.

Would you like me to focus on:

• A specific industry (e.g., healthcare, finance, tech)?
• A template for an audit checklist or report?
• Best practices for managing management pushback during findings?

Conducting an internal compliance audit is a systematic process to evaluate whether a company’s operations, policies, and procedures align with external laws, regulations, and internal standards.

Here is how a compliance officer typically conducts an audit, broken down into sequential phases:

1. Preparation and Planning

• Define Scope and Objectives: Determine what the audit will cover (e.g., data privacy, financial controls, workplace safety, or anti-corruption) and set clear objectives.
• Identify Applicable Standards: Review relevant laws, regulations, industry standards, and internal corporate policies that apply to the selected scope.
• Establish the Audit Team and Timeline: Assign responsibilities, assemble the audit team (including subject-matter experts if needed), and set a realistic schedule.
• Review Prior Audits: Examine past audit reports, historical findings, and unresolved issues to identify recurring risk areas.

2. Risk Assessment and Program Design

• Assess Risk Levels: Evaluate operational areas to prioritize high-risk processes that require deeper testing.
• Develop the Audit Program: Create a detailed audit plan, checklist, and testing methodology (such as sampling techniques or data analytics criteria) tailored to the objectives.

3. Fieldwork and Testing

• Conduct Interviews: Speak with key personnel and process owners to understand day-to-day operations and existing internal controls.
• Review Documentation: Examine records, policies, training logs, transaction reports, and previous communications.
• Test Controls: Perform substantive and control testing (e.g., verifying if approvals were properly documented, testing sample transactions) to ensure controls operate effectively.
• Gather Evidence: Secure objective, verifiable audit evidence to support any potential observations or discrepancies.

4. Evaluating Findings and Reporting

• Analyze Results: Compare the gathered evidence against established compliance criteria to identify deficiencies, gaps, or non-compliance instances.
• Draft the Audit Report: Summarize the scope, methodology, key findings, and risk levels associated with any deficiencies.
• Collaborate with Management: Discuss preliminary findings with relevant department heads to validate the facts and secure their initial input.

5. Corrective Action and Follow-Up

• Formulate Corrective Action Plans (CAPs): Work with management to design actionable steps, accountability assignments, and deadlines for fixing identified issues.
• Monitor Implementation: Track the progress of remediation efforts to ensure the deficiencies are properly resolved.
• Report to Leadership: Present the final audit results and remediation status to senior management and the Board of Directors or Audit Committee.

If you'd like, I can:

• Provide a sample audit checklist for a specific industry (like healthcare or finance)
• Explain how to structure an effective audit report
• Detail how to perform sample testing

A compliance officer typically conducts an internal compliance audit as a structured, risk-based review of whether the organization is following applicable laws, regulations, internal policies, and control requirements. A good audit doesn't merely look for violations—it tests whether the compliance program actually works.

A useful framework is ISO 19011:2026, which organizes auditing around planning, conducting, reporting, evidence, independence, and risk-based auditing.

1. Define the audit scope and objectives

First, the compliance officer determines:

• What is being audited—for example, anti-bribery, privacy, AML, workplace safety, HIPAA, procurement, or conflicts of interest.
• Why the audit is being performed.
• Which locations, departments, systems, transactions, and employees are included.
• What period is being examined.
• Which requirements constitute the audit criteria.

For example:

Objective: Determine whether the company's third-party due-diligence process complies with applicable anti-corruption requirements and the company's own third-party policy. The scope should be specific enough that the auditor can make a defensible conclusion.

2. Identify the applicable requirements

The auditor creates an audit criteria matrix showing what the organization is supposed to do.

Sources might include:

• Federal and state laws and regulations
• Industry regulations
• Licensing requirements
• Contractual obligations
• Regulatory guidance
• Corporate policies and procedures
• Internal controls
• Prior audit findings
• Board or management requirements

The auditor then translates those requirements into testable questions.

For example:

3. Perform a risk assessment

The auditor normally doesn't test everything equally. Higher-risk areas receive more attention.

Factors might include:

• Regulatory exposure
• Dollar value
• History of violations
• Complaints or whistleblower reports
• Previous audit findings
• Changes in regulations
• Rapid business growth
• High-risk countries or third parties
• Manual processes
• Management overrides
• Weak or missing controls

The U.S. Department of Justice, for example, specifically considers whether a company's internal-audit process identifies and audits high-risk areas and whether audit findings are reported to management and the board.

4. Develop an audit plan and testing program

The compliance officer documents:

• Audit scope
• Audit objectives
• Applicable requirements
• Processes to be examined
• Sampling methodology
• Interviews to conduct
• Documents/data to review
• Testing procedures
• Audit timeline
• Responsible auditors

They may create a compliance audit checklist or testing workbook.

Importantly, the auditor should maintain appropriate independence. ISO 19011:2026 identifies independence, evidence-based auditing, and risk-based auditing among its core principles.

5. Gather evidence

This is the heart of the audit.

The compliance officer gathers objective, verifiable evidence, such as:

• Policies and procedures
• Training records
• Contracts
• Transaction records
• Approval records
• System logs
• Expense reports
• Regulatory filings
• Employee certifications
• Investigation files
• Emails or other communications where appropriate
• Prior corrective-action documentation

They may also interview employees and observe processes.

The key question is:

"Show me evidence that this requirement is actually being followed." A policy saying employees must obtain approval is not enough. The auditor tests actual transactions to see whether approval occurred.

6. Test controls

The auditor compares what should happen against what actually happened.

Common testing techniques include:

Sampling

For example, select 30 vendor files from the audit period and determine whether each contains the required due diligence.

Inspection

Review documents, records, approvals, logs, and system configurations.

Interviews

Ask employees how the process actually works.

Observation

Watch employees perform the process.

Reperformance

Independently perform the control or calculation to determine whether it produces the expected result.

Data analysis

Search large datasets for anomalies—for example:

• Duplicate payments
• Unusual approval patterns
• Transactions just below approval thresholds
• Payments to high-risk jurisdictions
• Employees missing required training

7. Document exceptions and findings

When something doesn't comply, the auditor documents the condition, rather than simply saying "the company is noncompliant."

A strong finding generally answers:

1. What was supposed to happen?
2. What actually happened?
3. What evidence proves the difference?
4. Why did it happen?
5. What risk does it create?
6. How significant is it?

For example:

Finding: 7 of 50 sampled high-risk vendors did not have documented compliance approval before onboarding. Then the auditor determines whether this is an isolated error, a recurring control failure, or evidence of a systemic problem.

8. Determine the root cause

A sophisticated compliance audit doesn't stop at identifying the violation.

The officer asks why it occurred.

Possible root causes include:

• Employees weren't trained.
• The policy is unclear.
• The system doesn't enforce the requirement.
• Responsibility is poorly defined.
• Management routinely bypasses the control.
• The control exists on paper but isn't monitored.
• Staffing is inadequate.
• The procedure doesn't reflect actual business operations.

For example:

Problem: Employees aren't completing required training.

Root cause: The company sends reminders but has no escalation mechanism and managers aren't held accountable.

That leads to a much better remediation plan than simply saying "retrain employees."

9. Rate the findings

Findings are usually classified according to severity, such as:

• Critical
• High
• Medium
• Low
• Observation/opportunity for improvement

The rating considers factors such as regulatory exposure, likelihood, potential impact, duration, number of affected transactions, and whether the problem is systemic.

10. Discuss preliminary findings with management

Before issuing the final report, the auditor typically discusses significant findings with the responsible business owners.

This gives management an opportunity to:

• Clarify facts
• Provide additional evidence
• Correct factual errors
• Explain mitigating controls
• Begin remediation

This isn't supposed to turn into management negotiating away legitimate findings. The auditor's conclusions should remain evidence-based.

11. Issue the audit report

A typical internal compliance audit report contains:

• Executive summary
• Audit objectives
• Scope and methodology
• Applicable requirements
• Overall conclusion
• Findings
• Risk ratings
• Supporting evidence
• Root causes
• Management responses
• Corrective actions
• Responsible owners
• Due dates

A useful conclusion might be:

Overall assessment: Partially effective. The organization has established appropriate third-party due-diligence controls, but testing identified recurring deficiencies in documentation and approval. These weaknesses increase the risk that high-risk third parties could be onboarded without appropriate compliance review.

12. Track remediation

This is one of the most important parts.

The compliance officer assigns each finding to an owner and establishes:

• Corrective action
• Responsible person
• Target completion date
• Required evidence
• Validation method

Then compliance follows up.

For example:

The auditor should eventually verify that the corrective action actually fixed the problem, rather than simply accepting management's statement that it was fixed.

The audit cycle in simple terms

Plan → Assess risk → Identify requirements → Gather evidence → Test controls → Identify findings → Determine root cause → Report → Remediate → Validate → Monitor

This is consistent with the broader audit approach in ISO 19011:2026, which covers establishing an audit program, planning and conducting audits, reporting results, and monitoring/improving the audit program.

A practical example

Suppose you're auditing an anti-bribery compliance program.

You might:

1. Review the anti-bribery policy.
2. Identify applicable laws and company requirements.
3. Identify high-risk countries, vendors, and transactions.
4. Select 50 third parties for testing.
5. Review due-diligence files.
6. Check whether required approvals occurred.
7. Review gifts, entertainment, and payment records.
8. Interview procurement and sales personnel.
9. Analyze transactions for unusual patterns.
10. Document exceptions.
11. Determine root causes.
12. Rate the findings.
13. Report them to management/audit committee.
14. Agree on corrective actions.
15. Follow up and independently verify remediation.

The fundamental principle is: don't audit whether the organization has a policy; audit whether the organization actually follows it, whether the controls work, and whether there is evidence demonstrating that they work.

If you're learning this for a compliance officer job/interview, I can also give you a realistic internal compliance audit checklist and sample audit report.

7. Document exceptions and findings

When something doesn't comply, the auditor documents the condition, rather than simply saying "the company is noncompliant."

A strong finding generally answers:

1. What was supposed to happen?
2. What actually happened?
3. What evidence proves the difference?
4. Why did it happen?
5. What risk does it create?
6. How significant is it?

For example:

Finding: 7 of 50 sampled high-risk vendors did not have documented compliance approval before onboarding. Then the auditor determines whether this is an isolated error, a recurring control failure, or evidence of a systemic problem.

8. Determine the root cause

A sophisticated compliance audit doesn't stop at identifying the violation.

The officer asks why it occurred.

Possible root causes include:

• Employees weren't trained.
• The policy is unclear.
• The system doesn't enforce the requirement.
• Responsibility is poorly defined.
• Management routinely bypasses the control.
• The control exists on paper but isn't monitored.
• Staffing is inadequate.
• The procedure doesn't reflect actual business operations.

For example:

Problem: Employees aren't completing required training.

Root cause: The company sends reminders but has no escalation mechanism and managers aren't held accountable.

That leads to a much better remediation plan than simply saying "retrain employees."

9. Rate the findings

Findings are usually classified according to severity, such as:

• Critical
• High
• Medium
• Low
• Observation/opportunity for improvement

The rating considers factors such as regulatory exposure, likelihood, potential impact, duration, number of affected transactions, and whether the problem is systemic.

10. Discuss preliminary findings with management

Before issuing the final report, the auditor typically discusses significant findings with the responsible business owners.

This gives management an opportunity to:

• Clarify facts
• Provide additional evidence
• Correct factual errors
• Explain mitigating controls
• Begin remediation

This isn't supposed to turn into management negotiating away legitimate findings. The auditor's conclusions should remain evidence-based.

11. Issue the audit report

A typical internal compliance audit report contains:

• Executive summary
• Audit objectives
• Scope and methodology
• Applicable requirements
• Overall conclusion
• Findings
• Risk ratings
• Supporting evidence
• Root causes
• Management responses
• Corrective actions
• Responsible owners
• Due dates

A useful conclusion might be:

Overall assessment: Partially effective. The organization has established appropriate third-party due-diligence controls, but testing identified recurring deficiencies in documentation and approval. These weaknesses increase the risk that high-risk third parties could be onboarded without appropriate compliance review.

12. Track remediation

This is one of the most important parts.

The compliance officer assigns each finding to an owner and establishes:

• Corrective action
• Responsible person
• Target completion date
• Required evidence
• Validation method

Then compliance follows up.

For example:

The auditor should eventually verify that the corrective action actually fixed the problem, rather than simply accepting management's statement that it was fixed.

The audit cycle in simple terms

Plan → Assess risk → Identify requirements → Gather evidence → Test controls → Identify findings → Determine root cause → Report → Remediate → Validate → Monitor

This is consistent with the broader audit approach in ISO 19011:2026, which covers establishing an audit program, planning and conducting audits, reporting results, and monitoring/improving the audit program.

A practical example