EKO Industrials · PRD-IND-003
Internal Audit Framework
Sixteen requirements an internal audit function is assessed against, so that its audits mean the same thing whoever runs them.
Description
Audits happen, and then nobody can compare them. One auditor's Major is another's Minor. A finding closes because a date passed. The plan is whatever was convenient this quarter.
This framework states what must be true. Six principles, five roles, five elements of a working audit function, and sixteen numbered requirements an organisation can be measured against — from maintaining an audit universe to evidencing closure rather than asserting it.
Severity is defined once, here, so it is not re-decided per audit. Three levels with written definitions, and two rules that keep the scale meaningful: a count of findings is not a measure of quality, and severity is never adjusted to manage a reaction.
A four-level maturity model lets an organisation place itself honestly — and refuses partial credit. Meeting fourteen of sixteen requirements is level two, not level three.
Independence is treated as it actually is in a small organisation: where full independence is impossible, the limitation is recorded in the report rather than concealed.
Who it is for
The person who designs or governs the audit function — a manager standing one up, a quality lead who inherited one, a director who has to rely on its output. Not the practitioner, who wants PRD-IND-002.
The problem addressed
An audit function exists without a stated method, so its output cannot be compared year to year or relied on by anyone who did not run it.
The outcome
A stated method that produces comparable audits across teams, periods and auditors — and a way to say honestly where the function currently stands.
What is included
| Purpose and scope | With four explicit out-of-scope items |
|---|---|
| Six principles | Each with what it rules out |
| Five roles | With the one rule that prevents most dysfunction |
| Five method elements | Universe · Plan · Execution · Reporting · Follow-up |
| Sixteen numbered requirements | The assessable core |
| Evidence expectations | Working file · unexecuted tests recorded · closure evidenced |
| Four-level maturity model | Partial satisfaction confers no level |
| Interfaces | Including what is deliberately not depended on |
What is not included
| Not included | |
|---|---|
| A certification scheme | EKO certifies nothing. Meeting this certifies nothing |
| Any external standard | Named, never reproduced. Not a substitute for one that applies to you |
| A regulatory or compliance outcome | Adopting it produces none |
| How to conduct an audit | That is PRD-IND-002 |
| External certification audit · financial statement audit · misconduct investigation | Four explicit out-of-scope items |
| Any service, advice or assessment | None accompanies the file |
Format
One document. Eight required components, sixteen requirements, four maturity levels.