Skip to main content
Regulatory Council
green gradient background, "The Future of Application Security Is Already Here." and a read the report button.
Category: Internal Controls & Audit

Fieldwork

Also known as: Field work
Simply put

In the evidence provided, 'fieldwork' refers broadly to the practice of observing and collecting data directly in a real-world setting rather than in a lab or office. The available sources describe general and academic meanings, such as market research sessions with respondents or the observation and recording of geological, cultural, and environmental data. None of the provided sources address the specialized meaning of fieldwork used in internal audit or other GRC disciplines.

Formal definition

The evidence packet supports only a general definition: fieldwork is the process of directly observing, recording, and collecting data in a natural or real-world environment, as opposed to work performed remotely or in a controlled setting. Cited examples include qualitative and market research (recruiting and hosting research sessions with respondents), ethnographic or cultural observation, and geological field mapping and exploration. Note that in GRC practice, particularly internal audit, 'fieldwork' typically denotes a distinct engagement phase involving the gathering and evaluation of evidence, testing of controls, and preparation of working papers to support conclusions; however, no source in the provided evidence packet attests to or substantiates that audit-specific meaning. Practitioners should verify the internal-audit definition against primary authorities such as the IIA's Global Internal Audit Standards and applicable government auditing standards, which fall outside the scope of the evidence supplied here.

Why it matters

In everyday and academic usage, "fieldwork" signals a fundamental methodological choice: gathering data directly where phenomena occur rather than relying on secondhand accounts or controlled proxies. The evidence provided reflects this in several domains, qualitative market research firms that recruit respondents and host in-person, remote, or hybrid sessions; ethnographic and cultural observation described by educational sources as the process of observing and collecting data about people, cultures, and natural environments; and the earth sciences, where fieldwork traditionally involves geological mapping and exploration in a natural setting. The common thread is the reliability that comes from direct observation and firsthand recording of data.

For GRC professionals, the general concept matters because the same principle of firsthand evidence gathering underpins how assurance work is often conducted. It is important to note, however, that the evidence packet supplied here addresses only the general and academic meanings of the term. Practitioners should be aware that "fieldwork" also carries a well-established, specialized meaning in internal audit and government auditing, commonly denoting the engagement phase in which auditors gather and evaluate evidence, test controls, and prepare working papers. That audit-specific meaning is supported by primary authorities such as the IIA's Global Internal Audit Standards and government auditing standards, but those authorities are not part of the evidence provided here and were not evaluated for this entry.

Because the term spans plain-language, academic, and GRC-specific uses, readers should confirm which sense is intended in a given context. Applying a general definition where an audit-standards definition is required, or vice versa, can create ambiguity in scope, expectations, and documentation. When the internal-audit meaning is intended, the precise definition and any associated requirements should be verified against the applicable primary standards rather than inferred from general usage.

Who it's relevant to

Internal auditors
Auditors encounter "fieldwork" as a named phase of an engagement, but the specific procedures and documentation expectations for that phase come from primary authorities, not from the general definitions in this evidence packet. When applying the audit meaning, verify requirements against the IIA's Global Internal Audit Standards and, for public-sector work, applicable government auditing standards.
Compliance and risk professionals
Those who commission or review firsthand data collection, whether through research sessions, site visits, or environmental observation, benefit from understanding fieldwork as direct, real-world evidence gathering. They should confirm which sense of the term is intended in a given document to avoid conflating general observational work with a formal audit phase.
Researchers and analysts
Market researchers, ethnographers, and earth scientists use fieldwork in its methodological sense: observing and recording primary data in a natural or real-world setting rather than in a lab or office. The evidence here directly supports these uses, including qualitative research sessions, cultural observation, and geological mapping.
General counsel and governance leaders
Leaders overseeing assurance and investigative activities should recognize that "fieldwork" has both general and audit-specific meanings, and that matters of standards interpretation or legal significance may require professional advice. Where the term appears in charters, plans, or reports, its intended scope should be defined explicitly to prevent ambiguity.

Inside Fieldwork

Evidence gathering
The core activity of fieldwork, in which auditors collect sufficient, reliable, and relevant information to support engagement observations and conclusions. This phase typically follows engagement planning and precedes reporting.
Testing of controls and transactions
During fieldwork, auditors execute planned procedures to evaluate whether controls are designed appropriately and operating effectively, often examining transactions, records, and system outputs against expected criteria.
Sampling
A technique commonly applied in fieldwork to draw conclusions about a population by examining a subset of items. Approaches may be statistical or judgmental, and the method chosen affects the extent to which results can be projected across the population.
Working papers (audit documentation)
The records that document the procedures performed, evidence obtained, and conclusions reached during fieldwork. They provide support for the engagement's findings and serve as a basis for review and quality assurance.
Analytical and substantive procedures
Procedures such as comparisons, trend analysis, reconciliations, inspection, observation, inquiry, and re-performance used to obtain evidence and identify anomalies or areas warranting further examination.
Standards basis
Internal-audit fieldwork is supported by authoritative GRC frameworks. The IIA's professional guidance (historically the International Professional Practices Framework and its evolution into the Global Internal Audit Standards) addresses engagement performance, including evidence and documentation. In the U.S. government context, GAO's Government Auditing Standards (the Yellow Book) has historically included fieldwork-related standards governing evidence and documentation. Specific clause numbers, editions, and wording evolve, and practitioners should verify requirements against the current primary source.

Common questions

Answers to the questions practitioners most commonly ask about Fieldwork.

Is 'fieldwork' just an informal term, or does it have recognized standing in auditing standards?
Fieldwork is a recognized concept in professional auditing literature, not merely informal usage. In internal audit, it commonly refers to the evidence-gathering phase of an engagement, during which auditors execute the audit program, perform tests, and develop findings. Authoritative sources address this phase: the IIA's professional guidance (historically the International Professional Practices Framework, now reflected in the Global Internal Audit Standards) covers performing the engagement and gathering sufficient, reliable, relevant, and useful information, while the GAO's Government Auditing Standards (the 'Yellow Book') has historically included standards addressing the conduct of audit work. Readers should verify the current edition and specific wording of each source, as framework and standards language evolves across revisions.
Does fieldwork mean the same thing across internal audit, external audit, and other GRC contexts?
Not precisely. While the general sense, the on-site or hands-on phase of gathering evidence, is broadly shared, the specific expectations differ by context and governing standard. Internal audit fieldwork is shaped by the IIA's standards and the engagement's objectives; external financial audit fieldwork is governed by separate auditing standards focused on obtaining evidence to support an opinion on financial statements; and performance or government audits may follow the GAO Yellow Book. The term can also appear loosely in risk assessments, compliance reviews, and investigations. Because scope and requirements are context-dependent, the applicable standard for the specific engagement type should be consulted rather than assuming a single uniform definition.
What activities typically occur during the fieldwork phase of an audit?
Fieldwork typically follows planning and centers on executing the audit program. Common activities include examining records and documents, conducting interviews and walkthroughs, observing processes, testing controls, and performing analytical or substantive procedures. Auditors generally gather information intended to be sufficient, reliable, relevant, and useful to support conclusions, and they document their work as they proceed. The specific mix of procedures depends on the engagement objectives, assessed risks, and the applicable standards. Activities and terminology should be aligned with the governing framework for the engagement.
How are working papers used during fieldwork?
Working papers are the records that document the work performed, the evidence obtained, and the reasoning supporting observations and conclusions. During fieldwork, they are typically prepared or updated as procedures are executed, providing a trail that links audit objectives to procedures, procedures to evidence, and evidence to findings. Well-organized working papers can support supervisory review, quality assurance, and the eventual reporting of results. Documentation expectations vary by standard and organization, so the applicable requirements for form, content, and retention should be confirmed for the engagement in question.
What role does sampling play during fieldwork?
Sampling is often used during fieldwork when testing every item in a population is impractical. It involves selecting a subset of items to draw conclusions about the broader population. Approaches are commonly described as statistical (using probability-based selection and quantifiable evaluation) or non-statistical (relying on auditor judgment). The chosen method, sample size, and evaluation approach depend on the engagement objectives, assessed risk, and the applicable standards and methodology. Sampling supports conclusions but does not eliminate the possibility that results differ from the full population, so limitations should be considered when interpreting findings.
How does the fieldwork phase connect to planning and reporting?
Fieldwork typically sits between planning and reporting in the engagement lifecycle. Planning establishes the objectives, scope, and audit program that fieldwork executes, and it often informs the risk assessment that shapes the procedures performed. Fieldwork, in turn, generates the evidence and documented observations that feed into the reporting phase, where results and any conclusions or recommendations are communicated. Because findings can emerge during fieldwork that warrant adjusting scope or procedures, the phases are often iterative rather than strictly sequential. The specific structure and terminology should align with the applicable standards and the organization's methodology.

Common misconceptions

Fieldwork means auditors must be physically present at a site.
Fieldwork refers to the evidence-gathering phase of an engagement rather than a physical location. Procedures may be performed remotely or through electronic access to records and systems, depending on the engagement and available technology.
Completing fieldwork procedures guarantees that no material issues exist.
Fieldwork is typically based on sampling and professional judgment, which provide reasonable rather than absolute assurance. Even well-executed procedures cannot eliminate the possibility that some issues go undetected.
Fieldwork and planning are interchangeable stages of an engagement.
In many audit methodologies these are distinct phases. Planning establishes scope, objectives, and the procedures to be performed, while fieldwork executes those procedures and gathers the supporting evidence. The two are related but serve different purposes.

Best practices

Anchor fieldwork procedures to the objectives, scope, and risk assessment established during engagement planning so that evidence gathered is relevant to the conclusions being drawn.
Document procedures performed, evidence obtained, and conclusions reached in working papers contemporaneously, so the record is sufficient to support findings and to withstand independent review.
Select and justify a sampling approach appropriate to the population and engagement objective, and clearly note whether results can be projected across the population or are limited to the items examined.
Use a mix of procedure types, such as inspection, observation, inquiry, re-performance, and analytical review, to corroborate evidence rather than relying on a single source.
Align fieldwork practices with applicable authoritative standards (for example, the IIA's Global Internal Audit Standards or, in relevant government contexts, GAO Government Auditing Standards), verifying current requirements against the primary source, since editions and wording evolve.
Communicate significant observations to relevant stakeholders during fieldwork rather than deferring all issues to the reporting phase, allowing timely clarification and correction where appropriate.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide