Internal audit · what gets checked

Three questions, asked in this order

1
Does it exist?
For example

Is there a written access control policy, and does it say who approves access?

2
Does it match?
For example

Your policy says quarterly reviews. Your customer contract says monthly.

3
Do people do it?
For example

Show me the last four reviews, with dates and who ran them.