This paper describes the process that was followed at the Colombian National Audit Office, during 3.5 years, to develop new auditing practices, called second-order auditing. The purpose of the second-order control is to detect possible faults in the internal control mechanisms of the audited entities. General and particular models for second-order audit are presented, along with a method to carry out this type of auditing. Finally, a particular application of second-order auditing carried out in a Colombian national institution is