Internal audit of an asset management system

Two numbers, and any asset-intensive organisation can produce both in an afternoon. The share of the balance sheet its assets represent, and the share of the internal audit plan directed at them.

The first is usually the larger by a wide margin. The second is usually small, and much of what is there is maintenance procurement rather than the asset base itself.

This is not negligence and it is not a resourcing failure. It is a recognition problem, and it has a specific cause worth naming.

Why coverage lands where it lands

An internal audit function is built to examine transactions and the controls around them. Authorisation, segregation of duties, three way match, evidence of receipt, contract compliance. That capability is real, hard won and portable across the whole organisation.

Maintenance spend looks exactly like that. So does procurement of services, so does contractor payment, so does inventory. They fit the audit universe because they are transactional, and an audit of them produces findings of a kind the audit committee recognises and can act on.

The asset management system does not look like that at all. Whether the decision criteria exist, whether the plan has ever declined anything, whether the data supports the decisions it is used for, whether intervention timing is set by condition or by budget availability: these are not transactional questions. They have no population to sample and no control to test. They require an opinion about the basis on which the organisation makes multi-decade commitments.

The result is an organisation with high assurance over how it spends its maintenance budget and none at all over whether that budget is the right size.

Item	Sampleable	Not reachable by sampling
Maintenance spend
Contractor payment
Procurement of services
Inventory and stores
Whether decision criteria exist
Whether the plan has declined anything
Whether the data supports the decision
Whether timing is set by condition

The four on the right are where the money is decided rather than spent. A function that covers only the left-hand column reports that spending is controlled, which is true, and says nothing about whether it should have been spent.

FIG. 01Eight subjects, split by whether an audit function has an instrument for them. No proportions are shown, because none have been measured.

What the standard now requires be examined

The 2024 edition of ISO 55001 is more specific about this than its predecessor, and two clauses matter.

Clause 9.2 requires internal audit of the asset management system itself, on a programme that considers the importance of the processes concerned and the results of previous audits. The subject is the system, not the spend.

Clause 4.5, entirely new, requires the decision-making framework, the criteria and the methods to be documented. That has a direct consequence for assurance: the absence of documented criteria is now a nonconformity against a published standard, rather than a maturity observation an executive can absorb. It gives an auditor something to test against, which is exactly what was missing before.

What the criteria clause actually asks for

Four questions that examine the basis

None of these requires a sample. Each produces an answer a board can act on.

What has the plan stopped? A strategic asset management plan that prioritises is one that deprioritises. If nothing has ever been declined by reference to it, it is a description rather than a plan, whatever its quality.

When was the data last verified against the asset? Asset data degrades continuously and silently. Nothing announces that a record has stopped matching reality, so confidence in a register tends to rise with its age while its accuracy falls. The 2024 edition gives data and information their own subclause at 7.6, which ISO/TC 251 lists as revised, and the reading here is that attributes, quality and sources have to be determined rather than assumed.

Name one intervention whose timing was set by predicted condition. Clause 10.3 renamed preventive action to predictive action and rewrote it, moving the question from whether to intervene to when. Answering it requires condition data, a deterioration view and a funding mechanism that can act before failure. Most organisations have none of the three and describe a run to failure regime as risk-based.

Can the finance and engineering views of the same asset be reconciled, and how long does it take? Record the elapsed time and how many people had to be involved. That measurement is usually more informative than the reconciliation.

The competence problem this creates

There is an uncomfortable consequence, and it applies to the internal audit function rather than to the organisation it examines.

A reviewer who cannot interpret condition data, read a deterioration curve or price a renewal option will examine the controls surrounding those activities and report on the controls. That is a genuine finding about a real control environment. It is not a finding about the asset base, and the distinction is rarely drawn in the report, so the reader concludes the asset base was examined when the paperwork around it was.

The Global Internal Audit Standards, effective January 2025, require proficiency and due professional care, and the honest application of that requirement here is sometimes a decision to decline a scope or to bring in someone who holds the competence. ISO 55012, published in the 2024 family, covers people involvement and competence specifically.

The same question, in a delivery context

Why the pressure is arriving from finance

In Saudi Arabia the prompt for examining the basis is coming from the accounting reform rather than from the audit committee.

The Saudi Ministry of Finance describes High Order No. 13059 of December 2016 as approving the move of all government entities from cash to accrual accounting. The standards applied are the Saudi public sector accounting standards, which the Ministry adopts and which are based on IPSAS. Accrual accounting obliges an entity to recognise, value and depreciate what it controls, which requires it to establish what it controls and in what condition.

That produces, as a by-product, what may be the first defensible answer an organisation has had to the question of what it owns. It also produces an external auditor with a view on it, which is a different kind of pressure from an internal recommendation.

What the conversion demands of the register

The framework for this stage sets out all six domains and the published clause behind each.

The opportunity in that is easy to miss. An organisation being forced to build a defensible register is being forced to build the precondition for everything else in this article. Whether it also builds the decision framework, the plan and the data governance that make the register useful, or whether it builds a register that satisfies the accounts and nothing else, is a choice being made right now in a large number of organisations, mostly by people who do not know they are making it.

Sources. ISO 55001:2024, second edition, July 2024, ISO standard 83054: Clause 4.5 on asset management decision-making, Clause 7.6 on data and information, Clause 9.2 on internal audit and Clause 10.3 on predictive action. ISO 55000:2024, ISO standard 83053. ISO/TS 55010 on alignment of financial and non-financial functions, ISO 55012 on people involvement and competence and ISO 55013 on asset data, all published in the 2024 family. Global Internal Audit Standards, Institute of Internal Auditors, effective 9 January 2025. The Three Lines Model, Institute of Internal Auditors, Statement of Position of 8 July 2026. IPSAS 33, first-time adoption of accrual basis IPSAS. The Saudi Ministry of Finance's accounting standards page describes the transition to accrual accounting as approved by High Order No. 13059 of December 2016.

Audited on the transactions, unaudited on the basis