An audit is fundamentally a report on if what the target says is credible.

So, first you have to determine what the target says.

Then you look around to see if that seems accurate.

Then you look around to see what are the systems and controls that are in place to keep things in a controlled state in the future.