By role / Internal auditor
Your standards tell you how to audit. They do not tell you what to look at.
The auditing standards govern independence, evidence and reporting. Establishing the criteria is your job, and past contract closure there is very little published to build them from.
You have been asked to give assurance on a capital programme, or on an entity that is building assets it will shortly have to run. You are not the engineer, and none of your standards makes you one.
Standards governing your work
Government Auditing Standards, 2024 revision, GAO-24-106786, effective for performance audits beginning on or after 15 December 2025
Nine chapters: the foundation and use of the standards, general requirements for compliance, ethics and independence, competence and continuing education, quality management and peer review, and then the conduct and reporting of financial audits, attestation engagements and performance audits. Not one of them names a subject. GAGAS defines planning to include determining objectives, scope and methodology and establishing criteria to evaluate matters subject to audit, which puts the criteria on the auditor rather than in the standard.
Global Internal Audit Standards, Institute of Internal Auditors, effective 9 January 2025
Five domains and 15 principles covering the purpose of internal auditing, ethics and professionalism, governance of the function, its management, and the performance of services. The same shape as GAGAS: how the function is run and how an engagement is conducted, not what a capital programme should be measured against.
INTOSAI GUID 5280, Guidance for Audits of Public Procurement, 2022, free in full
The closest thing to a published, global question set for this ground. Three phases, pre-tendering, tendering and post-award, with annexes carrying roughly a hundred possible audit questions and a table of integrity risks at each step. It is also explicit about its own limits: paragraph 62 says the questions are a menu to choose from, are not exhaustive, and need to be completed with the applicable or designed audit criteria.
Read the sources
- Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States2024 revision; read 2026-09-04.Free in full. Effective for performance audits beginning on or after 15 December 2025.
- Global Internal Audit Standards, Institute of Internal Auditors2024 Global Internal Audit Standards; read 2026-08-20.
- INTOSAI GUID 5280, Guidance for Audits of Public Procurement, 20222022; read 2026-09-04.Free in full. Ten annexes, including possible audit questions for each of the three procurement phases.
Where that stops
GUID 5280 ends where the contract does. Its last post-award question asks whether the contract was closed only once the contracting authority formally recognised that all deliveries were complete and payments were released. Everything this publication is about starts one step after that: the asset exists, somebody has to run it, it has to appear in a register at a value somebody can defend, and it will cost more to keep than it did to build. The only place the asset register appears in GUID 5280 at all is in the integrity risk table, as something that might be stolen from before it is recorded. Whatever criteria you apply past that line, you will have written them yourself. What follows is a set you can argue with.
Whether the decision to build was made on evidence that would survive being read back, and whether the governance that approved it could have said no.
What to examine
- Need and outcome
Is there a stated outcome this asset is meant to produce, written down separately from a description of the asset itself?
- The decision-making framework
Are the criteria by which options were chosen written down, and is it recorded who was entitled to choose?
- Definition maturity and the estimate
Does the estimate state the class it was produced at, and does that class match the scope definition actually achieved?
- Sanction and the authority to stop
Who is entitled to stop this, and have they ever been given information that would let them?
Instruments
- The question bank
Every question this publication asks, drawn from the framework and the articles, filtered by stage and by source, printable.
- Lifecycle cost sensitivity
Take three real costed buildings and watch the construction share of lifecycle cost move from 66% to 7% while the data stays exactly the same.
Related writing
- A gate that has never been failed is not a control
- Weighting and scoring is the method the guidance warns against
- The largest contributor to optimism bias is the document that starts the project
- An estimate is a measure of how well the scope is defined
- Whether it was worth doing is the least evaluated question
Whether the reported position is the real one, and whether the assurance already being performed adds up to coverage or only to activity.
What to examine
- Baseline integrity
Is the baseline currently being reported against the one that was sanctioned, and if not, is every step between the two documented?
- Change, planned and unplanned
Are changes assessed before they are made, and does anyone examine changes that were made without being assessed?
- Forecast credibility
Does the forecast reflect what is now known, or does it reflect what was committed?
- Externally provided processes and services
Where activities that affect the asset have been placed outside the organisation, has the organisation retained the ability to know whether they were done?
- Competence of whoever is assuring
Do the people performing this assurance understand the thing they are examining, and where they do not, is the gap covered by someone who does?
Instruments
- Earned value calculator
From planned value, earned value and actual cost, the variances and indices; add the budget at completion for the estimates at completion. Formulas shown and cited.
- Reporting history check
It does not ask whether the project is healthy. It asks whether the reporting on it has ever produced a signal, across the whole history rather than this month.
Related writing
- Every programme performs well against a baseline it can move
- A forecast that never moves is not stable, it is unexamined
- Programme risk is not the sum of its functions
- Engaging an engineer satisfies the standard. Deferring to one does not.
- You can place the activity outside. You cannot place the accountability there
- Your contingency and their contingency are different money
- Reliability can be specified like mass. Building owners do not.
- The score that is not a number
- An extension of time is tested against records made during the delay
Whether the conditions for taking over were met or waived, and whether anybody tested the receiving organisation rather than only the plant.
What to examine
- Information transfer against stated requirements
Was what was delivered tested against what was asked for, by someone who will have to use it?
- Knowledge, as distinct from information
Has anyone captured why the asset is the way it is, and what was accepted rather than resolved?
- Taking over, and what was waived to achieve it
Were the contractual conditions for taking over actually met, and where they were not, who agreed to proceed and on what record?
- Operational readiness of the organisation
Does an organisation exist that is capable of operating this asset on the day it is handed over, with people in post?
Instruments
- Operational readiness check
Put the questions a readiness review will ask, condition by condition, and name the blockers with their references. The percentage counts your answers; the blockers apply a rule.
- Turnover package composer
What has to change hands at taking over, grouped by what it is for rather than by who produced it, with what depends on each item and how to tell whether it is any good.
- What follows the certificate, and when
Enter one completion date and get every consequential date under your contract regime, each computed from the clause that sets it.
Related writing
- At handover, every review arrives after the leverage has gone
- Completion describes the asset. Readiness describes the owner.
- Operational readiness has seven conditions. Handover delivers two.
- The only test the building ever gets
- Under FIDIC, taking over comes before acceptance
- A delivered file is not an accepted record
Whether the records describing what the entity owns are true, and whether the management system around them has ever changed a decision.
What to examine
- An asset management system that is scoped
Is there a defined asset management system, and is it written down which assets it covers and which it does not?
- The SAMP and the line back to organisational objectives
Can any asset management objective be traced upwards to an organisational objective, and downwards to something someone is doing this year?
- Asset data and its quality
Is the data the organisation makes decisions from of a quality anyone has determined, and does anyone know when it was last true?
- Performance evaluation and internal audit of the system
Is the asset management system itself audited, by people competent to audit it, on a programme derived from risk?
Instruments
- Asset register package
The financial register, the technical register and the crosswalk between them, generated together as one Excel workbook. The two registers share the asset tag, and every column states the requirement behind it.
- Criticality screen
Find the assets that have to be looked at separately, and see what a likelihood times consequence ranking does to that list.
Related writing
- Audited on the transactions, unaudited on the basis
- Every organisation has a risk register. Ask for the other one
- Nothing tells you when a record stopped being true
- A dashboard computed from your own beliefs is not informationin Delivery
- A strategic asset management plan that has never stopped anything is a description
- Conformance is not maturity, and the body that says so is selling nothing
In the asset lifecycle method
This page composes material published elsewhere on this site and adds no claim of its own. The arrangement into stages is this publication’s, as the framework says at length; the requirements above are quoted from documents that are free to read and linked next to each. Where a stage is empty for this role, it says so rather than being left out.