Most people believe an internal audit starts with an opening meeting.
Some think it begins when the auditor requests documents.
Others assume it starts with checklists, questionnaires, or ERP reports.
They’re all wrong.
The real audit begins much earlier.
It begins the moment you walk through the company’s front door.
Before the first document is reviewed…
Before the first interview…
Before the first transaction is tested…
An experienced auditor is already collecting evidence.
Not by asking questions.
By observing.
Because organizations reveal far more through their daily behavior than they ever do through prepared reports.
The First Five Minutes Tell a Story
Imagine visiting two manufacturing companies.
Both have similar revenues.
Both use the same ERP system.
Both have similar organizational structures.
Yet your first five minutes feel completely different.
In the first company:
- Visitors are greeted professionally.
- Security verifies identification.
- Employees know where visitors should report.
- The reception area is organized.
- Safety instructions are clearly displayed.
In the second company:
- Visitors walk in without being questioned.
- Security is distracted.
- Employees appear unsure about visitor procedures.
- Documents are left unattended at the reception desk.
- Sensitive information is visible on computer screens.
No audit has officially started.
Yet valuable observations have already been made.
Good auditors recognize that operational discipline often reflects the quality of internal controls.
Observation Is Evidence
Internal auditing is often associated with documents.
Invoices.
Purchase orders.
Contracts.
Financial reports.
These are important.
But they are only part of the evidence.
Observation is equally valuable.
An auditor notices things that rarely appear in spreadsheets.
Are employees following established procedures?
Do managers lead by example?
Are safety protocols respected?
Do departments communicate effectively?
Are workspaces organized or chaotic?
These observations help auditors understand how processes actually operate—not how they are described in policy manuals.
Culture Speaks Before People Do
Every organization has a culture.
You can often sense it before anyone introduces themselves.
Is there openness?
Or hesitation?
Do employees comfortably answer questions?
Or do they constantly look toward management before responding?
Are people collaborative?
Or protective of information?
Culture influences every control within an organization.
A company may have excellent policies on paper.
If the culture discourages transparency, those policies become far less effective.
That’s why experienced auditors pay attention to behavior long before reviewing documentation.
Small Details Often Reveal Big Risks
Many audit findings begin with seemingly insignificant observations.
A warehouse door left open.
Shared login credentials written on sticky notes.
Unsigned delivery documents stacked on a desk.
Fire exits blocked by inventory.
Purchase requests waiting in overflowing approval trays.
Employees using personal USB drives.
None of these observations may appear in an audit program.
Yet each one tells a story about operational discipline.
Risk rarely announces itself dramatically.
It usually whispers through small inconsistencies.
The Walk Through the Facility Is Part of the Audit
Some of the most valuable audit evidence comes from simply walking around.
Observe the production floor.
Visit the warehouse.
Walk through the finance department.
Spend time in procurement.
Notice how employees interact.
Ask yourself:
- Does reality match documented procedures?
- Are controls actually being followed?
- Are responsibilities clearly understood?
- Are employees creating workarounds?
- Does the physical environment support good controls?
Processes look very different when viewed in action compared to when described in presentations.
People Behave Differently Than Documents
Policies describe ideal behavior.
Observation reveals actual behavior.
A policy may require visitors to wear identification badges.
Do employees enforce it?
A procedure may require confidential documents to remain locked.
Are they?
The organization may require segregation of duties.
Does one employee still handle everything?
Documents explain intentions.
Observation explains reality.
This is why internal auditors never rely solely on written evidence.
Listening Is Observation Too
Observation isn’t limited to what you see.
It includes what you hear.
Conversations in hallways.
Discussions during meetings.
Questions employees ask.
Comments made casually over coffee.
An employee saying,
“We always do it this way because the system is too slow.”
may reveal more about process weaknesses than an entire procedure manual.
A supervisor mentioning,
“We’re still waiting for last month’s approvals.”
may expose workflow bottlenecks.
Listening helps auditors understand where formal processes differ from operational reality.
Body Language Can Reveal Control Weaknesses
Experienced interviewers know that answers are only part of the conversation.
Confidence.
Hesitation.
Consistency.
Uncertainty.
These often provide additional context.
If several employees give completely different explanations of the same process, the issue may not be dishonesty.
It may indicate poor training or unclear procedures.
If managers struggle to explain approval limits, governance may require strengthening.
Observation complements documentation.
Neither should replace the other.
Operational Discipline Is Visible
Well-controlled organizations often display consistent operational habits.
Documents are organized.
Approvals happen on time.
Employees understand responsibilities.
Safety procedures are respected.
Systems are used consistently.
Weak control environments often reveal themselves differently.
Temporary workarounds become permanent.
Manual processes replace automated controls.
Approvals remain pending.
Documentation becomes inconsistent.
People depend on memory rather than process.
The physical workplace frequently mirrors the maturity of the control environment.
Internal Auditors Observe Connections
An experienced auditor doesn’t observe isolated events.
They observe relationships.
How procurement interacts with finance.
How operations communicate with inventory.
How IT supports business users.
How leadership responds to problems.
The objective isn’t simply to identify isolated weaknesses.
It’s to understand how the organization functions as a complete system.
Every interaction provides another clue.
Technology Doesn’t Replace Observation
Modern internal audit relies heavily on technology.
ERP analytics.
Continuous auditing.
Artificial intelligence.
Process mining.
Data dashboards.
These tools are powerful.
But they cannot replace human observation.
A dashboard may identify delayed approvals.
Only a site visit explains why employees avoid the approval system.
Data identifies patterns.
Observation explains behavior.
Together, they create meaningful audit insights.
The Best Auditors Stay Curious
Curiosity is one of the most valuable audit skills.
Instead of assuming, they ask.
Instead of judging, they observe.
Instead of rushing to conclusions, they connect evidence.
Simple questions often produce remarkable insights.
Why is everyone carrying paper forms when the ERP system exists?
Why are employees using unofficial spreadsheets?
Why does every manager mention the same operational challenge?
Why does the warehouse look different from documented layouts?
Every observation becomes another piece of the larger puzzle.
Internal Audit Is About Understanding Reality
The purpose of internal audit isn’t to prove whether policies exist.
It’s to determine whether they work.
Reality matters more than documentation.
Organizations rarely fail because they lack policies.
They fail because daily behavior gradually drifts away from those policies.
Observation helps auditors recognize that gap.
The sooner it is identified, the easier it is to correct.
Final Thoughts
The best auditors don’t switch into audit mode during the opening meeting.
They’re already auditing before anyone realizes it.
The moment they enter the facility…
The moment they greet the receptionist…
The moment they walk through the warehouse…
The moment they observe employees interacting…
The audit has already begun.
Because internal audit isn’t just about reviewing documents.
It’s about understanding people.
Understanding processes.
Understanding culture.
And understanding how an organization behaves when nobody thinks they’re being evaluated.
The most valuable audit evidence often isn’t found in a spreadsheet or an invoice.
It’s found in the everyday moments that most people walk past without ever noticing.
And that’s why every great audit starts long before the first checklist is opened.