While pricing is a factor, the core internal control issue is the absence of a mechanism to assess whether the vendor continues to meet performance, quality, and value expectations. Automatic renewals without review can lead to increased risk, degraded service, and a lack of accountability, which is a key concern for internal audit in evaluating governance processes.

A foundational step in understanding any process is to review its formal governance framework—the policy and procedure. This provides the auditor with the intended design of controls, roles, and responsibilities, against which actual practices can later be compared during interviews, walkthroughs, and testing.

While a new system is the long-term solution, the immediate risk of erroneous data must be mitigated. Recommending compensating controls, such as a secondary review or reconciliation process, addresses the current risk without being operationally disruptive (like shutting it down) or passive (just documenting it). It demonstrates a practical, risk-based approach.

This is a core governance concept. The board and senior management establish the level of risk they are willing to accept (risk appetite) to achieve objectives. Internal controls are then established (by management) to provide reasonable assurance that risks are mitigated to remain within that defined appetite. Internal auditors assess the design and operating effectiveness of these controls.

Professionalism involves respectful engagement. The best practice is to calmly refer back to the factual, objective criteria outlined in the audit methodology (such as financial impact, regulatory non-compliance, or reputational damage) that led to the conclusion. This moves the discussion from opinion to a fact-based dialogue about risk.

Evaluating design adequacy is a separate step from testing operating effectiveness. It is a theoretical assessment: “Assuming this control is performed correctly 100% of the time, would it address the identified risk?” Questions about consistency, cost, and training relate to implementation and operation, not the fundamental design.

Internal audit should be a collaborative partner in risk management. A rigid stance can be counterproductive. The professional approach is to understand the legitimate reasons for the delay (e.g., resource constraints, higher priorities) and formally update the plan with a new, realistic deadline. This maintains accountability while being pragmatic.

The Three Lines Model clarifies roles: The First Line (operational management) owns risk and is responsible for implementing and operating controls. The Second Line (functions like risk or compliance) oversees and facilitates. The Third Line (internal audit) provides independent assurance. Setting risk appetite is a governing body role, and challenging/advising is typically Second Line.

A walkthrough is a validation and information-gathering tool. By tracing one or a few transactions from start to finish and asking questions along the way, the auditor confirms that the process in practice matches the understanding gained from interviews and documentation. It identifies potential disconnects before detailed testing begins.

While pricing is a factor, the core internal control issue is the absence of a mechanism to assess whether the vendor continues to meet performance, quality, and value expectations. Automatic renewals without review can lead to increased risk, degraded service, and a lack of accountability, which is a key concern for internal audit in evaluating governance processes.0