This paper describes the process that was followed at the Colombian Nationa
l Audit Office, during 3.5 years, to develop new auditing practices, called
second-order auditing. The purpose of the second-order control is to detec
t possible faults in the internal control mechanisms of the audited entitie
s. General and particular models for second-order audit are presented, alon
g with a method to carry out this type of auditing. Finally, a particular a
pplication of second-order auditing carried out in a Colombian national ins
titution is presented.