When a business is small, the owner sees everything. Every purchase, every payment, every new hire. Then the company grows to three sites and dozens of staff, and one day a supplier is paid twice, a former employee is still on the payroll, and nobody can explain the stock count.
None of it is dramatic. That is the problem. Control gaps grow quietly until they show up as losses, fraud or a buyer's due diligence that goes badly.
Internal audit is how you find them first. Here is a practical checklist you can use, area by area.
What internal audit is
Internal audit is an independent check that your controls work in practice, not just on paper. It answers one question: are the rules we rely on actually being followed? It is different from your external audit, which gives an opinion on the financial statements.
When an SME needs it
- The owner can no longer see every transaction personally.
- You are preparing for investment, a bank facility or a sale.
- Something has already gone wrong, and you want to know what else might have.
- Major clients or tenders ask about your controls.
Controls that look good on paper do not always work in practice. Internal audit is how you find out which.
The checklist, area by area
1. Procurement and payables
- Purchases above a set value need quotes and approval
- New suppliers are checked before being added to the system
- Invoices match purchase orders and delivery notes
- Payments are approved by someone other than the person who raised them
- Duplicate supplier records and duplicate payments are checked
2. Payroll and WPS
- Joiners and leavers are processed on time, with approvals
- Payroll is reconciled to HR records every month
- Salaries are paid through WPS, on time
- Overtime and allowances are approved and match policy
- End-of-service calculations are checked
3. Inventory and stores
- Stock counts happen regularly and differences are investigated
- Issues from stores are recorded against a job or cost centre
- Slow-moving and damaged stock is identified
- Access to stores is restricted
4. Sales, billing and receivables
- Every completed job or delivery is invoiced
- Credit limits are set and followed
- Overdue balances are followed up and escalated
- Credit notes and discounts need approval
5. Cash and bank
- Bank reconciliations are done monthly and reviewed
- Bank signatories and online banking access are current
- Petty cash is counted and reconciled
6. Fixed assets
- An asset register exists and matches what is on site
- Vehicles and equipment have assigned users
- Disposals are approved and recorded
7. HR and labour compliance
- Employment contracts and policies follow the UAE Labour Law
- Personnel files are complete and up to date
- Leave, working hours and end-of-service are handled as required
8. IT and access
- Leavers lose system access on their last day
- Users only have the access their role needs
- Data is backed up and a restore has been tested
9. Tax records
- VAT returns reconcile to the accounts
- Records support corporate tax filings
- Supporting documents are kept for the required period
Short on time to audit it yourself? Our internal audit team can run it for you, as a one-off review or an outsourced function. Book a consultation.
How to run your first audit
- Start with risk. Pick the two or three areas where a failure would hurt most. A risk register tells you where to look.
- Understand the process. Walk through how it really works with the people who do it.
- Test a sample. Pick transactions and check each control: approval, matching documents, timing.
- Find the root cause. Ask why a control failed, not just that it did.
- Agree actions. Every finding gets an owner and a date, and you follow up.
What a good report looks like
| Column | What it contains |
|---|---|
| Finding | What you found, with examples |
| Risk rating | High, medium or low |
| Root cause | Why it happened |
| Recommendation | A practical fix |
| Owner and date | Who fixes it, and by when |
| Status | Updated at follow-up |
Keep it short. A five-page report with clear actions gets read. A forty-page one gets filed.
Common mistakes
- Auditing everything at once, and finishing nothing.
- Auditing your own work. Independence matters.
- Reporting problems without owners or dates.
- Never following up. Unfixed findings are worse than unknown ones, because now you knew.
Key takeaways
- Internal audit checks that controls work in practice.
- Use the nine-area checklist, but start with your two or three riskiest areas.
- Test real samples and find the root cause of every failure.
- Every finding needs an owner, a date and a follow-up.
- Independence matters: do not audit your own processes.
Free download
Get the internal audit checklist as a PDF
The full checklist across nine areas, with space to record findings, owners and dates. Enter your details and the download starts straight away.
Thank you, . Your download is starting.
If it does not start, use the button below. A consultant may follow up to see if you need help.
Related reading
FAQ
Questions owners ask about internal audit
How often should an SME run internal audits?
Most SMEs benefit from a yearly plan that covers the highest-risk areas first, with follow-up on actions every quarter.
Who should do internal audit in a small company?
Someone independent of the processes being audited. Many SMEs outsource it, because they do not have an independent person in-house.
What is the difference between internal and external audit?
External audit gives an opinion on your financial statements. Internal audit checks that day-to-day controls work, and helps you fix them.
Is outsourced internal audit cheaper than hiring?
For many SMEs, yes. You pay for the reviews you need, with experienced auditors, instead of a full-time salary.
What is sample testing?
Checking a selection of transactions, for example 25 payments, against the control that should apply, to see whether it works in practice.
Want an independent check of your controls?
We run risk-based internal audits for UAE SMEs and family groups, with clear findings and follow-up.