Running internal audit in Workiva: plans, fieldwork, findings, and follow-up

An internal audit function runs the same cycle regardless of tool:

1. Risk-based audit plan. Which areas of the audit universe to cover this year and why.
2. Engagement planning. Scope, objectives, timing, team, and the risks and controls in scope.
3. Fieldwork. Procedures performed, evidence obtained, and conclusions, documented in workpapers.
4. Review. A reviewer signs off each workpaper or sends it back with notes.
5. Findings and reporting. Issues rated, management action plans agreed, and the report issued.
6. Follow-up. Each action tracked to completion and verified before it is closed.

In Workiva, each of these becomes a structured record linked to the next. The benefit is that status, open findings, and overdue actions can be reported from the records rather than compiled by hand before each audit committee meeting.

The engagement template. Standard sections for planning, fieldwork, and reporting mean every engagement looks the same to a reviewer. Keep it close to your methodology manual and to the conformance expectations of the IIA’s Global Internal Audit Standards (effective January 2025), and resist building a different template for every audit type.

Workpaper structure. Decide what a workpaper must contain: objective, procedure, population and sample, results, conclusion, preparer, reviewer. Consistent structure is what makes review fast.

Review and sign-off. Who can review, whether review notes must be cleared before sign-off, and whether the audit leader signs the engagement as a whole.

Findings and ratings. A single rating scale, clear criteria for each level, and a required management action plan with an owner and due date for each finding.

Follow-up. How management reports progress, what evidence closes an action, and who verifies it. Overdue actions should be visible without anyone building a spreadsheet. The issue remediation and closure example walks through one finding from identification to verified closure.

Many organizations run SOX and internal audit in the same Workiva environment. Sharing processes, risks, and controls lets internal audit reference SOX testing instead of repeating it, and lets the audit plan reflect known control weaknesses. It also creates a question that needs a clear answer: who maintains the shared records. Decide that before go-live. For the SOX side, see how Workiva Controls Management supports SOX.

The committee typically wants plan progress, significant findings, and the status of management actions, especially overdue ones. If those views come from the engagement and finding records, the report is current whenever it is opened. If the team is still assembling it from exports, that is usually the first improvement worth making.

Bring over open findings and actions first, since those carry obligations. Historical engagements can often move as reference documents rather than fully structured records. Start with the next engagement on the plan, run it end to end in Workiva, and adjust the template based on what the team actually needed.