Internal audits can help RTOs achieve compliance objectives by monitoring how the effectiveness your organisation’s risk management, processes and governance. The goal of an internal audit is to ensure management has oversight of how effectual the RTO self-assurance systems and processes in place are. The internal audit process can be conducted using internal resources or you can outsource an external consultant, however it is critical that the person or team carrying out the internal audit is independent and objective. This will ensure the internal auditor is free of any bias or influence from the team or department being assessed and the data provided to management is impartial.

Develop your internal audit plan:

Your audit plan should identify areas that need reviewing within your RTO. This should include legislative requirements such as the SRTOs 2015 and contractual obligations such as funding agreements. A risk-based approach including risk assessing your RTO’s scope of registration will determine the priorities that need to be included in your planning. Ensure you consult with internal stakeholders to determine other risks that have been identified during business as usual and refer to your historical audit outcomes to see other known risks.

Create an internal audit calendar:

Develop an audit calendar that determines the frequency of your internal audit activity based on the risks identified and levels of severity. This may be monthly or quarterly based on your organisation’s needs but auditing less frequently gives you and your internal auditors more flexibility. You should ensure you consult widely with relevant RTO staff regarding the proposed timetable of audits to ensure there are no conflicts or clashes with other critical business activities.

Preparing for internal audits:

Ensure you communicate effectively with RTO staff regarding your audit plan and schedule. Notify them well in advance of a planned audit so they can have the necessary evidence ready and available for the internal auditor. Holding a kick-off meeting is a good way to provide staff involved with an opportunity to understand the process and logistics involved with your planned activity. Ensure you provide a defined agenda that outlines the discussion to be had in advance so staff can be prepared and contribute.

Documenting internal audit outcomes:

The value in your internal audit processes comes from the audit activity data you obtain and how effectively you document the audit outcomes. Effective communication of internal audit findings helps promote the relationship between risk management and self-assurance. A good audit report also facilitates effective resolution of rectifications and systemic issues identified. The internal audit report should provide a clear summary of identified issues, risks, and recommendations to your internal stakeholders.