Management override of controls is one of the few fraud risks that every audit must address, whatever the size or sector of the entity. The most direct way to address it is journal entry testing: pulling the general ledger, checking it is complete, and using risk-based criteria to find the entries that deserve a closer look. This article shows how to perform a solid first pass in Excel today.
Most internal audit teams still look at a process once a year, test a sample and report months after the transactions took place. By the time a finding reaches the audit committee, the duplicate payment has cleared, the supplier has gone and the control weakness has been there for a whole financial year. Continuous auditing and continuous monitoring change the timing. Instead of looking back once, you test whole populations of transactions on a regular cycle and deal with exceptions while they still matter.
This guide explains the difference, gives a step-by-step approach, a template you can adapt, and the mistakes that usually derail these programmes.
Almost every audit report you write rests on one question: is internal control working? The COSO Internal Control – Integrated Framework is the most widely used yardstick for answering it. Banks, listed companies, state-owned enterprises, public sector ministries and NGOs across Africa use it, whether they name it or not, to design controls, and auditors use it to evaluate them. This guide explains what the framework requires, why it matters, where organisations commonly fall short, and gives you a checklist you can use on your next engagement.
Every audit opinion and every internal audit finding rests on one thing: evidence. If the evidence is thin, unreliable or poorly documented, even a correct conclusion can fall apart under review by a quality inspector, an audit committee or a regulator. ISA 500, Audit Evidence, sets out what counts as audit evidence and what the auditor must do to make sure it is good enough to rely on.
This guide explains what ISA 500 requires, why it matters in practice, where audit teams commonly fall short, and a short checklist you can use on your next engagement. Its principles apply equally to internal auditors and risk and compliance officers.
Every audit team knows the feeling. The report was issued, management agreed to every recommendation, and twelve months later the same findings appear again in the next review. The audit added insight but not change. Tracking recommendations through to closure is where internal audit proves its value, and it is also where many teams in Zimbabwe and across Africa are weakest, especially when follow-up lives in a spreadsheet that one person maintains.
This article sets out a practical, step-by-step approach to tracking audit recommendations, a simple tracker template you can adopt today, and the mistakes that most often leave findings open long after their due dates.
Fraud is the risk every auditor worries about and few feel fully equipped to handle. ISA 240, The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements, sets out what auditors must do: not to guarantee that no fraud exists, but to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error.
The standard is also changing. The IAASB issued ISA 240 (Revised) in July 2025, effective for audits of financial statements for periods beginning on or after 15 December 2026. For a December year-end client, that means the 2027 audit. This article covers what the standard requires, what the revision changes, the gaps we see most often in practice, and a checklist your team can use now.
Before you test a single transaction, you should know what the population looks like. How many payments are small? Where does the money actually sit? Which items are so unusual they deserve a look on their own? Stratification and outlier analysis answer those questions in minutes, and they are among the most useful first steps in any data-driven audit, whether you are reviewing a creditors ledger at a parastatal, loan disbursements at a bank or grant payments at an NGO.
This article explains what each technique finds, walks through a worked example, and gives step-by-step Excel instructions you can use on your own data today.
Almost no audit tests every transaction. Whether you are testing payment approvals at a parastatal, loan files at a bank or grant expenditure at an NGO, you will usually examine a sample and draw a conclusion about the whole population. ISA 530, Audit Sampling, sets out how to do that so the conclusion is defensible. Here is what it requires, where files fall short, and a checklist for your next engagement.
Yesterday’s article covered what ISA 530 requires. Today we move from the standard to the desk: how do you actually […]
Pre-numbered documents are one of the oldest controls in accounting. Invoices, receipts, cheques, goods received notes and fuel coupons are numbered in sequence so that every document can be accounted for. When a number goes missing, something has happened: a cancelled document, a system glitch, or a transaction that someone did not want recorded. Gap testing is the audit data technique that finds those missing numbers quickly and completely, across the whole population rather than a sample.
This article explains what gap testing finds, walks through a worked example, and gives you step-by-step Excel instructions you can try on your own data today.
