Where does an internal auditor typically spend most of his time auditing today?

Modern internal auditing predominantly employs a risk-based approach, which focuses on the organization's key business processes. Auditors spend most of their time evaluating the design and operational effectiveness of these processes and the internal controls embedded within them. This process-centric view is the most effective way to provide assurance that risks to organizational objectives are being managed appropriately. While people, technology, and infrastructure are critical components, they are typically audited as integral parts of a broader business process, rather than as standalone entities. Auditing the process provides a holistic view of how all components work together to manage risk.

A. People: While human factors are a source of risk, auditors evaluate roles, responsibilities, and actions within the context of a process, not as the primary audit subject.
C. Technology: IT audits are crucial, but technology is an enabler of business processes. It is audited to ensure it supports the process securely and effectively.
D. Infrastructure: This is a specific and narrow component. Auditing physical or IT infrastructure is part of a larger audit scope, not the main area of focus.

1. ISO 31000:2018, Risk management — Guidelines, Clause 6.6, "Monitoring and review." This clause emphasizes that the purpose of monitoring and review (a key function of internal audit) is to "assure and improve the quality and effectiveness of risk management process design, implementation and outcomes." This directly links the assurance function to the process.

2. Gramling, A. A., & Schneider, A. (2018). The future of internal auditing is now: A call for action. Accounting Horizons, 32(3), 57-66. (DOI: https://doi.org/10.2308/acch-52138). This paper discusses the evolution of internal audit, stating on page 58 that a core competency is a "deep understanding of the business, its processes, and its strategy" to provide effective assurance.

3. The University of Texas at Austin, McCombs School of Business, Course ACC 384.2, Internal Auditing. The course syllabus and description outline a curriculum structured around understanding and auditing key business processes (e.g., revenue, purchasing, production). This pedagogical approach reflects modern audit practice where the business process is the central unit of analysis.

4. Sarens, G., & De Beelde, I. (2006). Internal auditors' perception about their role in risk management. Managerial Auditing Journal, 21(1), 63-80. (DOI: https://doi.org/10.1108/02686900610634765). The study highlights the shift in internal audit from traditional compliance checks to a broader role in risk management, which involves analyzing and providing assurance over entire business processes.