Internal audit testing of anti-corruption controls

Internal audit has a central role in testing the operational effectiveness of anti-corruption controls. Rather than confirming that policies exist on paper, it can test whether safeguards prevent, detect and respond to bribery, fraud and conflicts of interest in everyday operations.

For Australian organisations, this assurance must fit a distinctive business environment. Sydney and Melbourne are major centres for headquarters, procurement, legal teams and shared services; ASX-listed companies operate under governance expectations monitored by ASIC; and imports passing through Australian customs create counterparties, permits and records that may conceal indirect payments.

The Australian market also includes resource companies, franchise networks and small businesses trading across borders, each with different exposure. Internal audit should translate those conditions into a risk-based assurance plan, while management and the audit committee retain clear accountability for prevention, monitoring and remediation.

Set the scope through enterprise risk

An internal audit plan for bribery and corruption begins with enterprise risks, not a generic checklist. Auditors map bribery schemes to the organisation’s value chain: sales bids, public tenders, agents, distributors, hospitality, facilitation payments, payroll, donations and government-facing activity. Each risk is linked to a control owner, an inherent-risk rating and the likelihood that misconduct could reach the board or external stakeholders.

Legal obligations help define scope without replacing risk assessment. Section 130 of the Commonwealth Criminal Code Act 1994 addresses bribery of foreign public officials, while the Crimes Act 1914 and state and territory laws cover other bribery offences. Commonwealth procurement requirements, AUSTRAC obligations for covered entities and the Australian government’s integrity framework can also shape exposure. A payment may comply with a narrow legal test while still breaching the organisation’s ethical standards, so internal audit should examine both.

The audit committee should approve the anti-corruption assurance plan and clarify whether testing will include financial statement implications, regulatory compliance and the design of incentive arrangements. Audit teams can use practical anti-corruption resources to refresh country and sector risk assumptions. A sound plan allocates sample sizes and fieldwork according to material risk rather than giving equal attention to every site.

Separate design from operating effectiveness

Control design and operating effectiveness answer different questions. Design effectiveness asks whether a control, if properly performed, would prevent or detect the relevant misconduct. A gifts register may be well designed, but that says nothing about whether managers record every offer, employees report benefits and reviewers challenge unexplained patterns. Auditors should identify preventive, detective and corrective controls intended to address each risk.

Operating-effectiveness testing follows the control from instruction to evidence. Auditors inspect approved policies, sample transactions over a representative period, observe approvals, re-perform reconciliations and interview the people who perform the control. Exceptions should be analysed as clusters rather than counted mechanically: three unsupported claims involving the same agent may reveal a broken due-diligence process. Where external auditors intend to rely on internal audit work, the respective teams should also reconcile their approaches with relevant Australian Auditing Standards, including ASA 315 and ASA 320.

Culture is a control condition, not a substitute for one. Positive reinforcement can strengthen the willingness to raise concerns. The cooperative use of reward, choice and consistent boundaries in safe off-leash play provides a plain analogy for encouraging the desired behaviour. In a company, credible recognition for refusing improper requests can reinforce compliance, provided recognition does not discourage reporting or turn disclosure into a performance test.

Trace risks through transactions and third parties

Anti-corruption risks often sit inside a chain of events, so testing one final approval is rarely enough. Audit should trace a transaction from the original customer or supplier request through price approval, bank instructions and performance of the work. It should compare related payments with the approved rationale, especially where an intermediary, side agreement, unexplained fee or unusual payment condition appears.

Customs activity provides a relevant Australian example. For businesses importing equipment, food or raw materials, Australian Border Force documentation and customs brokers may form part of the control path. Auditors can test the accuracy of origin declarations, broker due diligence, duty records, transshipment evidence and invoice descriptions. Mineral and agricultural exporters in Western Australia and Queensland face additional risks when counterparties, agents, ownership structures or freight routes change without documented approval.

Third-party assessment is more than checking a registration number. The team should test whether ownership and beneficial interests were verified, adverse media was considered, reference checks were completed, risk ratings were approved and enhanced monitoring was applied when circumstances changed. If a process lacks expertise, specialist portal support can help teams frame due-diligence questions or locate relevant guidance, although management remains responsible for engagement decisions.

Test reporting and investigation controls

Reporting channels and investigation procedures need the same evidence-based testing as financial controls. Internal audit should review the channels available to employees, contractors and external parties, confirm that cases can be made anonymously where promised, and sample handling files for timeliness, impartiality and appropriate confidentiality. The audit should establish whether allegations concerning senior figures, investigators or internal auditors are escalated outside the normal chain.

A hotline that receives reports but provides no feedback is only partially operational. Auditors should test acknowledgement times, triage decisions, conflict checks, investigative depth, closure reasons and protection from retaliation. Where a case overlaps with fraud, employment law, privacy or regulatory reporting, the process should preserve evidence and involve qualified legal or forensic support without turning every employee report into a full investigation. Repeat allegations, unexplained case closure and delayed escalation can all be warning signs.

Employee health, leave and psychological safety can affect whether people speak up, particularly where misconduct is being concealed through workplace pressure. A control that sends distressed staff to an unmonitored mailbox may suppress escalation. Auditors can recommend that managers receive guidance on confidential referrals to professional support and that the intranet maintains a visible link to credible employee illness support. Such measures should sit alongside independent reporting routes and anti-retaliation protections; a supportive culture is not evidence that misconduct has been investigated.

Evaluate evidence and communicate findings

Audit conclusions should distinguish a control failure from an isolated breach. If a contractor invoice was paid without the required approval, that establishes an exception. It becomes a control-design issue only if proper performance would not have caught the payment; it becomes a wider root-cause issue if weak incentives, unclear authority or poor supervision caused the breach. This discipline keeps recommendations proportionate, evidence-based and defensible.

Findings should be graded by impact and likelihood, with an explicit rationale. A high-impact issue may warrant immediate escalation even when no loss has been proved, while a low-impact documentation gap can be grouped for correction. The report to the audit committee should show affected sites, control objectives, test evidence, management responses, responsible owners, due dates and any scope limitation. For ASX-listed entities, the audit committee can also consider whether a matter affects governance, director oversight or financial reporting.

Potential criminal conduct requires a careful handover. Internal audit may support fact-finding, preserve records and report through approved channels, but it should not make findings of guilt or manage a legal defence unless authorised to do so. The general counsel, audit committee and relevant regulator should agree on escalation and external reporting, including conflicts between confidentiality obligations and legal duties. Clear minutes and documented decision points can show that action was taken by people with the appropriate mandate.

Turn findings into sustained control improvement

Remediation works when it changes the operating environment rather than closing a ticket. For each significant finding, management should document the root cause, select an accountable owner, define a dated action and specify the evidence that will prove completion. Internal audit should validate that evidence, challenge vague milestones and escalate overdue high-risk actions to the audit committee. Actions may include redrafting a delegation of authority, automating a control, changing incentive arrangements, conducting targeted training or strengthening contractual monitoring rights.

The follow-up phase can use test results to establish better indicators across the Australian business. Auditors may monitor overdue due-diligence reviews, gifts recorded after the transaction date, split purchase orders, unusual freight amendments and repeated travel to high-risk locations. Data analytics can flag patterns, but it cannot replace judgement: a red flag identifies where to ask questions, not what misconduct occurred. Continuous monitoring should feed the next annual risk plan and allow audit teams to adjust testing when the risk profile changes.

Internal audit’s value is strongest when its assurance influences how the organisation earns and protects trust. It should communicate what was tested, what assurance resulted and where uncertainty remains, while allowing management to act on findings without compromising audit independence. The next step is to hold a single two-hour walkthrough with the owners of the five highest-value anti-corruption controls and document the transaction sample and evidence to be tested next quarter.