An operational audit examines how a business process actually runs and asks three things: is it designed well, does it work in practice, and is it efficient. It is the most common type of internal audit and the one most likely to find money and time, not only errors. The approach is the same each time: define the scope, map the real process, test it, and report what to change.
Last reviewed: 17 October 2026. Facts checked. The framing follows general internal audit practice and a secondary summary of the IIA Three Lines Model. The two examples are illustrative, with invented numbers left out. We did not check ICAI Standards on Internal Audit numbering, which is being updated.
What operational audit is
It looks at operations, not just records. A financial audit asks whether the numbers are right. An operational audit asks whether the process producing them is sound. It sits within the wider family in types of internal audit.
It is also different from performance audit. Operational audit reviews a process against its design and good practice. Performance audit judges a programme against its stated results and cost. See performance audit vs operational audit.
Step 1: Set the scope
A tight scope is half the job. Write down:
- The process, with start and end points (for example, purchase requisition to vendor payment).
- The objective, such as "reduce duplicate payments" or "shorten month-end close".
- The period under review.
- What is out of scope, so nobody assumes you covered it.
- The risks you will focus on, taken from the risk assessment.
The internal audit SOW generator can help draft this.
Step 2: Understand the real process
Documents describe the intended process. People describe the real one. Do both.
- Read policies and any process maps.
- Hold walkthroughs with the people who do the work.
- Follow one transaction from start to finish.
- Note every handoff, approval and system.
Gaps between the paper process and the real one are findings in themselves.
Step 3: Identify risks and controls
For each step, list what could go wrong and what stops it. A risk and control matrix (RCM) holds this in one table. Build it with the internal audit RCM builder.
Step 4: Test
Test two things separately.
| Test | Question | Example |
|---|---|---|
| Design | Would this control stop the risk if it worked? | Is there a three-way match before payment? |
| Operation | Did it work in the period? | Sample payments and check the match happened |
| Efficiency | Is the effort proportionate? | Time taken, rework, manual steps |
Use data analytics where you can. Testing the full population finds more than a sample. See continuous internal audit and full-population testing.
Step 5: Report
Each observation should state the condition, the criteria, the cause, the effect and the recommendation. Agree the facts with the process owner first. Then agree an action, an owner and a date. The structure is in internal audit report format.
Worked example 1: procure-to-pay
Scope: Purchase requisition to payment, one financial year.
What the walkthrough finds: Purchase orders are sometimes raised after the invoice arrives. Vendor master changes are made by the same person who processes payments.
What testing shows: A sample of invoices shows some without goods receipt. Analytics on the full payment file turns up repeat amounts to the same vendor.
Recommendations: Block invoice posting without a purchase order, separate vendor master maintenance from payment, and run a monthly duplicate payment check. The duplicate payment test kit is a starting point. A full checklist is in procure-to-pay internal audit RCM checklist.
Worked example 2: month-end close
Scope: The close process from the last transaction date to management accounts sign-off.
What the walkthrough finds: The close depends on a spreadsheet that one person maintains. Reconciliations are done in the last two days, so errors surface late.
Recommendations: Move reconciliations earlier, set a close calendar with owners, and review the spreadsheet logic. More in record-to-report internal audit checklist.
Common mistakes
- A scope that is too wide. A tight scope done well beats a broad one done thinly.
- Auditing the policy, not the practice. Always follow a live transaction.
- Findings with no cause. Without the cause, the fix treats a symptom.
- Recommendations the owner cannot act on. Agree them before the report is final.
Frequently Asked Questions
What is an operational audit?
A review of how a process runs, covering design, operation and efficiency. It aims to improve the process, not only to find errors.
How is operational audit different from financial audit?
Financial audit checks whether records are reliable. Operational audit checks whether the process behind the records is sound and efficient.
Who performs an operational audit?
Usually the internal audit team or an outsourced internal auditor appointed by the board or audit committee.
How long does an operational audit take?
It depends on process size and data quality. Agree the timeline in the scope document rather than assuming a fixed duration.
Do I need a risk and control matrix?
It is not legally required, but it keeps testing tied to risks and makes the work repeatable.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error