Internal Audit & Assurance

Internal audit and assurance studies how independent verification establishes whether control measures — compliance, risk, continuity — actually function as claimed, separate from the party executing them. It works with audit planning, sampling and findings reporting to a body not itself responsible for execution.

FM executes many of the control measures later audited — maintenance, inspections, access — and is rarely the auditor itself. Understanding how assurance works helps FM withstand an audit without being surprised by what counts as evidence.

• Is the evidence FM supplies actually auditable, or is it a narrative without underlying records?
• Does the internal audit function report independently of the line that manages FM?

• IIA International Professional Practices Framework (IPPF) — professional standards for internal audit.
• ISO 19011 — guidelines for auditing management systems.

• An audit finding without an independent reporting line to the board loses its value as assurance.
• FM records set up only for internal use rarely meet auditability requirements without adjustment.

• Statutory inspections and records (source of audit evidence)

• Record-keeping and evidence preparation for external review

• Regieorganisatie — managing organisation / intelligent client function

  Audits of outsourced execution require contractually secured audit rights, not after-the-fact trust.

• ISO 19011:2018; IIA IPPF (professional framework, not an ISO standard).

The standards section arrives in Part 7.

• Self-assessment by the executing department presented as independent assurance.

Continuous auditing based on live system data (instead of periodic sampling) is being explored but requires a data consistency most FM environments do not yet offer.

• IIA International Professional Practices Framework.
• ISO 19011:2018, guidelines for auditing management systems.