Internal Audit Procedures

1. Purpose & Scope

The Internal Audit function provides independent, objective assurance and consulting services designed to add value and improve Aevum Zenth's operations. This procedure covers:

• Financial statement assurance and transaction testing
• Operational efficiency and process optimization reviews
• IT general controls (ITGC), cybersecurity, and data privacy audits
• Regulatory compliance across 62 operating jurisdictions
• Third-party vendor and supply chain due diligence

Exclusions: Fraud investigations are governed separately under AZ-FIN-INV-2023. Disciplinary actions remain the purview of HR and Legal.

2. Audit Framework & Standards

All audit activities align with internationally recognized standards and internal governance mandates:

3. Governance & Oversight

4. Annual Audit Planning

The annual audit plan is risk-based, dynamic, and approved by the Audit Committee. The planning cycle follows these phases:

1. Risk Universe Mapping: Top-down assessment of strategic, operational, financial, and compliance risks across all 400 subsidiaries.
2. Inherent & Residual Risk Scoring: Matrix evaluation (Impact × Likelihood) using AZ-Risk-Scoring v4.1.
3. Resource Allocation: Staffing, budget, and external specialist engagement (cyber, forensics, sector experts).
4. Plan Approval: Submitted to Audit Committee by October 15 for January 1 effective date.

Adjustments: Mid-year plan amendments require CAE and Audit Committee Chair approval for >15% scope deviation or emergency audits.

5. Fieldwork & Execution

5.1 Engagement Lifecycle

5.2 Evidence & Working Papers

All working papers must be:

• Timestamped, version-controlled, and stored in the AZ Audit Management System (AMS)
• Cross-referenced to audit objectives and risk controls
• Reviewable by CAE and external quality assessors

6. Reporting & Communication

Findings are classified by severity using a standardized risk matrix:

• Critical: Material financial impact, regulatory breach, or systemic control failure. Deadline: 14 days
• High: Significant operational risk or design deficiency. Deadline: 30 days
• Medium: Moderate control gap with mitigating factors. Deadline: 60 days
• Low: Process improvement or minor documentation gap. Deadline: 90 days

Reports include: Executive Summary, Detailed Findings, Root Cause Analysis, Management Action Plans, and Risk Ratings. Distribution is strictly need-to-know per AZ-Data-Classification Policy.

7. Remediation & Follow-up

The Internal Audit function maintains a centralized Corrective Action Plan (CAP) tracker. Follow-up procedures include:

1. Monthly status reviews with process owners
2. Validation testing (documentation review, re-performance, or system verification)
3. Escalation to Audit Committee for overdue Critical/High items (>30 days past deadline)
4. Closure only upon CAE sign-off confirming effective remediation

8. Quality Assurance & Improvement Program (QAIP)

Continuous quality monitoring is mandatory per IIA Standard 1300:

• Ongoing Monitoring: Real-time review of working papers, supervisor sign-offs, and methodology adherence
• Periodic Reviews: Internal QA reviews quarterly; External assessment every 5 years (next due: 2026)
• Metrics Tracked: Audit cycle time, finding recurrence rate, management satisfaction, remediation closure rate

9. Data Access & Confidentiality

Audit personnel operate under strict data handling protocols:

• Access granted via AZ-IDM with least-privilege principles
• All data extracted must be anonymized where PII/PCI/SPI is involved
• Encryption at rest (AES-256) and in transit (TLS 1.3+)
• Immediate revocation upon engagement closure or role change

10. Version History