Re: Process Audits
You could begin by simply asking: "What is required of this process?" What are the objectives of the Purchasing Process? We can call this Input.
Next you could ask: "Did this indeed happen?" Did the Purchasing Process deliver the expected results? We call this Output. If the output meets the input requirements, you could say that this is an effective process. If not, you investigate (audit) the elements that make up this process. You could look at people, information, materials, equipment, environment, etc., that impact the process.
One must be careful not to confuse the difference between what the inputs and outputs are and other requirements for the process, including controls. Certainly, the objectives for the process must be taken into consideration, but they're
not inputs. Indeed, they are necessary for the process to be measured and monitored, but inputs, they aren't.
It's just like a vehicle used to complete a journey. You put fuel in it, and you measure acceleration/speed/time or distance covered on that fuel, to meet the objective of getting somewhere as fast or frugally as possible. The output is, of course the work done by the engine, plus noise, exhaust, heat etc (which should add up to the input...)
In your example, the input to purchasing is a demand/requisition for something to be bought, the output is a PO which describes that demand in sufficient detail for a supply to comply. An objective for the process might be the time taken to 'convert' the requisition into an authorized PO placed with a supplier.
As Helmut stated, the internal auditor should have studied these and any process/process control documentation which describes the assignment of their audit. After detailed planning, the auditor must then ask very focused questions of management and have them demonstrate the process is a) being done per the description and b) meeting the objectives set. If it's not performing, what are they doing about it?
Going into an audit without any planning/knowledge of the process and asking vaugue questions will be a voyage of discovery, but that's not what an internal audit is for.......