Where does an internal auditor typically spend most of his time auditing today?

Modern internal auditing predominantly employs a risk-based approach, which focuses on the organization's key business processes. Auditors spend most of their time evaluating the design and operational effectiveness of these processes and the internal controls embedded within them. This process-centric view is the most effective way to provide assurance that risks to organizational objectives are being managed appropriately. While people, technology, and infrastructure are critical components, they are typically audited as integral parts of a broader business process, rather than as standalone entities. Auditing the process provides a holistic view of how all components work together to manage risk.

A. People: While human factors are a source of risk, auditors evaluate roles, responsibilities, and actions within the context of a process, not as the primary audit subject.

C. Technology: IT audits are crucial, but technology is an enabler of business processes. It is audited to ensure it supports the process securely and effectively.

D. Infrastructure: This is a specific and narrow component. Auditing physical or IT infrastructure is part of a larger audit scope, not the main area of focus.

1. ISO 31000:2018

Risk management — Guidelines

Clause 6.6

"Monitoring and review." This clause emphasizes that the purpose of monitoring and review (a key function of internal audit) is to "assure and improve the quality and effectiveness of risk management process design

implementation and outcomes." This directly links the assurance function to the process.

2. Gramling

A. A.

& Schneider

A. (2018). The future of internal auditing is now: A call for action. Accounting Horizons

32(3)

57-66. (DOI: https://doi.org/10.2308/acch-52138). This paper discusses the evolution of internal audit

stating on page 58 that a core competency is a "deep understanding of the business

its processes

and its strategy" to provide effective assurance.

3. The University of Texas at Austin

McCombs School of Business

Course ACC 384.2

Internal Auditing. The course syllabus and description outline a curriculum structured around understanding and auditing key business processes (e.g.

revenue

purchasing

production). This pedagogical approach reflects modern audit practice where the business process is the central unit of analysis.

4. Sarens

G.

& De Beelde

I. (2006). Internal auditors' perception about their role in risk management. Managerial Auditing Journal

21(1)

63-80. (DOI: https://doi.org/10.1108/02686900610634765). The study highlights the shift in internal audit from traditional compliance checks to a broader role in risk management

which involves analyzing and providing assurance over entire business processes.