Skip to main content
Policy Authority
Category: Internal Audit

Audit Fieldwork

Also known as: Fieldwork, Audit Field Work
Simply put

Audit fieldwork is the stage of an audit where auditors do the hands-on work of gathering evidence, such as testing transactions, reviewing documents, and checking whether internal controls are working. It typically comes after the audit has been planned and before the results are reported. The specific activities can vary depending on the type of audit and the organization being examined.

Formal definition

Audit fieldwork is the execution phase of an audit engagement, situated between planning and reporting, in which auditors gather and evaluate evidence to support their conclusions. Typical activities include testing transactions, examining documentation, evaluating the design and operation of internal controls, and meeting with relevant personnel to assess the adequacy of controls and compliance. As an assurance activity, fieldwork is distinct from the management processes and controls being examined; auditors observe and test rather than perform the underlying operational functions. The scope, location (on-site or remote), and testing procedures commonly vary by the nature of the audit, the client, and the availability of records.

Why it matters

Audit fieldwork is where the evidentiary basis for an audit opinion or conclusion is actually built. Planning sets the scope and identifies what to test, and reporting communicates the results, but it is during fieldwork that auditors gather and evaluate the evidence that supports their conclusions. Weak or incomplete fieldwork undermines the credibility of the entire engagement, because conclusions can only be as reliable as the testing, documentation, and evaluation that underpin them.

Fieldwork is also the point at which the independence of assurance activity is most visible in practice. Auditors observe and test the controls and processes operated by management rather than performing those operational functions themselves. Maintaining this distinction throughout fieldwork is what allows the resulting assurance to be meaningful; if auditors were to take on management's control activities, they would be examining their own work and the objectivity of the engagement would be compromised.

Because fieldwork depends on access to records and personnel, it is frequently where engagements encounter delays. As practitioners note, this is the stage where audits can slow down, as evidence must be collected, testing steps applied, results documented, and findings confirmed to tie out before review. The availability of records, the format of documentation, and whether work is conducted on-site or remotely all shape how efficiently fieldwork proceeds.

Who it's relevant to

Internal auditors
Internal auditors carry out fieldwork as the core execution stage of their engagements, applying testing steps, gathering evidence, and documenting results while remaining independent of the operations they examine. Understanding how fieldwork fits between planning and reporting helps them manage timelines and maintain the objectivity expected of an assurance function.
Control and process owners
Managers and staff who own the controls and processes under review are typically the personnel auditors meet with and whose documentation is tested during fieldwork. Their timely provision of records and access, and the format in which records are kept, directly affect how smoothly fieldwork proceeds.
Compliance and risk professionals
Those responsible for compliance and control environments interact with fieldwork as the point at which the adequacy of internal controls and compliance is assessed through testing rather than self-assertion. The findings emerging from fieldwork can inform where remediation or strengthening of controls may be warranted.
Audit sponsors and governance bodies
Audit committees and other governance stakeholders rely on the evidence gathered during fieldwork as the basis for the conclusions later reported to them. An awareness that fieldwork is often where engagements slow down helps set realistic expectations around reporting timelines.

Inside Audit Fieldwork

Evidence Gathering
The systematic collection of information sufficient and appropriate to support audit observations, typically through techniques such as inspection of documents, observation of processes, inquiry of personnel, and reperformance of activities.
Control Testing
The examination of whether controls are designed appropriately and operating effectively over the period under review, commonly involving tests of design and tests of operating effectiveness.
Sampling
The selection of a subset of items from a population to draw conclusions about the whole, using approaches such as statistical or judgmental sampling depending on the audit objective and the assurance required.
Working Papers
The documentation that records the procedures performed, evidence obtained, and conclusions reached, providing a basis for review and supporting the audit's findings.
Interviews and Walkthroughs
Structured discussions with process owners and end-to-end tracing of transactions or activities to confirm understanding of how a process and its controls actually operate.
Observation Development
The formulation of preliminary findings by comparing the condition identified against the applicable criteria, and identifying the cause and potential effect, before conclusions are validated with management.

Common questions

Answers to the questions practitioners most commonly ask about Audit Fieldwork.

Is audit fieldwork the same as the audit itself?
No. Fieldwork is one phase within a broader audit engagement, not the entire audit. It typically follows planning and scoping and precedes reporting and follow-up. During fieldwork, auditors gather and evaluate evidence to test whether controls are designed and operating as intended, but the surrounding activities, defining objectives, assessing risk, communicating results, and tracking remediation, sit outside fieldwork proper.
Does audit fieldwork mean the auditor is performing or fixing the controls being examined?
No. Fieldwork is an assurance activity, and it must remain distinct from the management activities it examines. Auditors observe, test, and evaluate controls; they do not design, operate, or remediate them, as doing so would compromise the independence and objectivity expected of an assurance function. Where auditors provide advice, that advisory role is typically kept separate from assurance work over the same area.
What types of evidence are commonly gathered during fieldwork?
Fieldwork commonly draws on a mix of evidence, which may include inspection of documents and records, observation of processes, inquiry of personnel, re-performance of control activities, and analytical procedures. Practitioners generally weigh the sufficiency and appropriateness of evidence, and corroborated or independently sourced evidence is often regarded as more persuasive than inquiry alone. The specific mix varies with the objectives, the area under review, and available data.
How are fieldwork findings typically documented?
Findings are commonly captured in working papers that record the objective, the procedures performed, the evidence examined, and the conclusions reached, so that the work can be reviewed and, where needed, reproduced. Many functions structure observations around a condition, criteria, cause, effect, and recommendation. Documentation practices vary by organization and by any professional standards the function has adopted.
How is sampling approached during fieldwork?
When testing a population is impractical, auditors often examine a sample. Approaches may be statistical or judgmental, and the choice typically reflects the population size, the risk involved, and the assurance sought. Sampling introduces the possibility that a sample may not represent the full population, so conclusions drawn from samples are generally expressed with that limitation in mind. This entry does not cover specific sampling formulas or tooling.
How do auditors maintain independence and objectivity while conducting fieldwork within an audited area?
Independence and objectivity are commonly supported by keeping the auditor's role limited to evaluation rather than operation of the controls, avoiding self-review of work the auditor previously performed, and reporting through lines that preserve the function's separation from operational management. In the three lines model articulated by the Institute of Internal Auditors, internal audit generally operates as an independent assurance provider distinct from the management and oversight functions it reviews. Specific safeguards vary by organization and applicable standards.

Common misconceptions

Fieldwork is where the auditor designs and implements the controls being examined.
Fieldwork is an assurance activity in which the auditor independently tests and evaluates controls that management owns and operates. Designing or implementing controls would compromise the auditor's independence and objectivity.
Testing a sample and finding no exceptions proves the control worked perfectly across the entire population.
Sampling supports a conclusion about a population but does not provide absolute certainty; sampling carries inherent risk that the sample may not fully represent the population, so results are expressed with qualified rather than definitive assurance.
Fieldwork observations are final conclusions ready for the report.
Observations developed during fieldwork are typically preliminary and are commonly validated with management to confirm factual accuracy before they are finalized in reporting.

Best practices

Anchor each test procedure to a defined audit objective and to explicit criteria so that observations can be evaluated against a clear standard.
Document working papers contemporaneously and completely, so that another competent reviewer could follow the procedures performed, the evidence obtained, and the conclusions reached.
Select sampling approaches deliberately, distinguishing statistical from judgmental methods, and record the rationale for the sample size and selection basis.
Prioritize sufficient and appropriate evidence, corroborating inquiry with more reliable techniques such as inspection, observation, or reperformance rather than relying on inquiry alone.
Validate factual accuracy of preliminary observations with process owners before finalizing conclusions, while preserving the auditor's independent judgment on the findings.
Maintain independence and objectivity throughout by testing and evaluating controls without assuming responsibility for designing, implementing, or operating them.
Promotional banner for the Pentest Readiness checklist download