What it means
Auditors broadly have two ways to slice their work. A vertical audit takes one business unit and reviews everything it does, while a horizontal audit takes one activity and follows it across all units.
Both are legitimate, and most audit plans use a mix, but they surface very different problems. Horizontal audits are good at finding inconsistency.
If procurement approval limits are respected in three divisions and quietly ignored in a fourth, a vertical audit of the compliant divisions would report nothing wrong, whereas a horizontal audit puts all four side by side and the gap is obvious. That comparison is the whole value of the approach.
The practical method is to define the process tightly, select a sample of transactions from every unit, test them against the same checklist, and then tabulate exception rates by location. Because the test is identical everywhere, the results are genuinely comparable, and the audit committee can rank units rather than reading six unrelated narratives.
Horizontal audits are also the natural fit for compliance topics that cut across the whole organisation, such as data protection, health and safety, supplier onboarding or revenue recognition. Regulators and certification bodies frequently expect this shape of testing because a control that works in only some places is not really a control at all.
The main limitation is depth. Looking at one process everywhere means you see very little about how any single unit operates as a whole, so a horizontal audit will rarely catch a localised fraud that lives outside the tested process.
Good audit plans therefore rotate: horizontal work for consistency, vertical work for depth.
In practice
Real-world examples.
Example
A hotel group audits its cash handling procedure across 22 properties in one exercise. Nineteen sites reconcile takings daily as required, two reconcile weekly and one has no documented reconciliation at all. The audit report ranks the sites and the group rolls out a single till procedure.
Example
A medical devices manufacturer runs a horizontal audit of supplier qualification records across four factories ahead of a regulatory inspection. Two factories hold complete documentation, one is missing recent audits for three suppliers, and the fourth uses an outdated approved supplier list. Remediation is completed before the inspector arrives.
Example
A charity audits its grant approval process across all six programme areas. It finds that grants under $10,000 are being split into smaller awards in one area to stay below the trustee approval threshold. The finding prompts a change to the policy wording.
Formula
Calculation
Exception rate = Exceptions found / Items tested, then Estimated population exceptions = Exception rate x Population size
An internal audit team reviews purchase order approvals across eight business units. It tests 50 orders in each unit, giving 400 items tested, and finds 36 that were approved by someone without the required authority. The exception rate is 36 / 400 = 9%.
The company processed 5,000 purchase orders in the year, so the estimated number of improperly approved orders is 9% x 5,000 = 450. If the average value at risk on each of those orders is $120 in unnecessary or unapproved spend, the estimated annual exposure is 450 x $120 = $54,000. That figure is what turns an audit finding into a budget conversation the board will act on.Case study
Seen in the real world.
This is an illustrative scenario involving a fictional retail chain, Northgate Provisions, which operated 40 stores through four regional managers. Head office had never doubted its stock write-off controls because each region reported its own figures and each set of figures looked plausible in isolation.
The new head of internal audit ran a horizontal audit of a single process: the authorisation and recording of damaged stock write-offs. She tested 25 write-offs per region against the same checklist. Three regions showed exception rates between 4% and 8%, while the fourth showed 44%, driven by write-offs recorded without a second signature and without any photographic evidence.
Nothing in that fourth region's monthly reporting had looked unusual, because its write-off percentage sat close to the group average. The horizontal comparison, not the reported totals, is what exposed the control failure, and in this illustrative case a tightened procedure recovered a meaningful share of the loss within two quarters.
Watch out
Common mistakes.
- Using different test criteria or sample sizes in different units, which destroys comparability and turns a horizontal audit into several unrelated small audits.
- Reporting only the group average exception rate, which hides the single outlier unit that the exercise was designed to find.
- Assuming a clean horizontal audit means a unit is well run, when the audit only ever looked at one narrow process in that unit.
Questions
People also ask.
What is the difference between a horizontal and a vertical audit?
A horizontal audit tests one process across many units, while a vertical audit tests many processes within one unit.
Is a horizontal audit only for large companies?
No, any organisation with more than one team, site or product line can compare the same process across them, and smaller businesses often find it the cheapest way to spot inconsistency.
How large should the sample be in each unit?
Sample sizes should be equal across units and large enough that a single exception does not swing the rate wildly, with 25 to 60 items per unit being a common practical range.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%