Category: Internal Audit and Assurance

Internal Audit Function

Also known as: IA, Internal Auditing, Internal Audit Activity

Simply put

An internal audit function is an independent group within an organization that reviews how well the organization manages risks, controls, and governance. It provides objective assessments to help the organization operate effectively, protect value, and improve its processes. Unlike an external auditor, it works on behalf of the organization itself, typically reporting to those charged with oversight.

Formal definition

The internal audit function is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It typically evaluates and helps improve the effectiveness of risk management, control, and governance processes, commonly reviewing, assessing, and monitoring the design and operating effectiveness of internal controls. In this capacity it often assists management and those charged with oversight in monitoring internal control policies and procedures, and may assess performance or process execution against defined standards, policies, and criteria. The scope, mandate, and reporting lines of the function vary by organization, sector, and jurisdiction; this entry is educational and not legal, audit, or compliance advice.

Why it matters

The internal audit function provides objective assurance that an organization's risk management, control, and governance processes are working as intended. By independently evaluating these areas, internal audit helps an organization achieve its objectives, protect value, and build trust among stakeholders. Its independence and objectivity are what distinguish its assessments from self-reviews by the functions that own the underlying activities, giving the board and its audit committee a source of assurance that is not compromised by day-to-day operational responsibilities.

Without a capable internal audit function, those charged with oversight may lack a reliable, independent view of whether controls are designed appropriately and operating effectively. Internal audit typically helps close this gap by reviewing, assessing, and monitoring controls and by testing whether processes are executed in line with defined standards, policies, and criteria. This supports informed oversight and can surface weaknesses before they escalate into losses, control failures, or reputational harm.

It is important to note that the scope, mandate, and reporting lines of an internal audit function vary by organization, sector, and jurisdiction, and requirements for having such a function differ accordingly. Internal audit provides assurance and consulting but does not itself own the risks or controls it reviews; accountability for managing risk and maintaining controls remains with management. This entry is educational and not legal, audit, or compliance advice.

Who it's relevant to

Boards and Audit Committees

Those charged with oversight rely on internal audit for an independent, objective view of whether risk management, control, and governance processes are effective. Because internal audit typically reports to this level, it serves as a key source of assurance that is not constrained by operational management's day-to-day responsibilities.

Chief Audit Executives and Internal Auditors

The professionals who lead and staff the function are directly responsible for delivering independent, objective assurance and consulting. Their work centers on evaluating risk, controls, and governance, and on reviewing, assessing, and monitoring the design and operating effectiveness of internal controls.

Senior Management

Management remains accountable for owning risks and maintaining controls. Internal audit commonly assists management in monitoring the design and proper functioning of internal control policies and procedures, and may assess how well processes are executed against defined standards, policies, and criteria.

Risk and Compliance Functions

Risk and compliance teams have interests that overlap with internal audit's assurance work but sit in distinct roles. Internal audit provides independent evaluation of the control and governance processes these functions help operate, without assuming ownership of the risks or controls being reviewed.

Inside IA

Independent Assurance Role

Internal audit typically serves as the third line in the three lines model, providing objective assurance to the board and audit committee on the effectiveness of governance, risk management, and internal control. Its independence from the management activities it reviews is central to the value of its work.

Audit Charter

A formal document, generally approved by the audit committee, that defines internal audit's purpose, authority, scope, and reporting relationships. It commonly establishes the function's right of access to records, personnel, and assets, and its organizational positioning to support objectivity.

Risk-Based Audit Planning

An approach in which the audit plan is prioritized according to the organization's assessed risks rather than covering all areas uniformly. The plan is typically reviewed and approved by the audit committee and updated as the risk profile changes.

Reporting Lines

Internal audit generally reports functionally to the audit committee (or board) and administratively to senior management. This dual reporting structure is designed to preserve independence while enabling day-to-day operation, and the distinction matters for who directs and evaluates the function.

Engagement Execution and Documentation

The performance of individual audits, including evaluating both control design and operating effectiveness, gathering evidence, and documenting findings. Distinguishing whether a control is well-designed from whether it operates effectively is a core discipline of the work.

Follow-Up on Remediation

A process for tracking management's response to audit findings and confirming that agreed actions are implemented. Ownership of remediation rests with management; internal audit's role is generally to monitor and report on progress, not to remediate.

Common questions

Answers to the questions practitioners most commonly ask about IA.

Does internal audit own or manage the organization's risks and controls?

No. Internal audit does not own risks or operate controls; that accountability sits with management, which typically constitutes the first and second lines. Internal audit generally serves as the third line, providing independent and objective assurance over the design and operating effectiveness of governance, risk management, and control processes. Conflating the assurance role with the ownership role undermines the independence that gives internal audit its value. The specific structure and mandate depend on the entity, its adopted framework, and applicable requirements.

Is internal audit the same as external audit or a compliance function?

No. These are distinct functions with different mandates. External audit typically expresses an opinion on the fairness of financial statements for the benefit of shareholders and other external users, often driven by statutory or listing requirements. A compliance function generally operates within management's second line to help the organization meet legal and regulatory obligations. Internal audit provides broader independent assurance across governance, risk, and control, and in many arrangements reports functionally to the audit committee. The scope and reporting lines vary by jurisdiction, sector, and entity type.

To whom should the internal audit function report to protect its independence?

Under many governance frameworks and codes, the chief audit executive reports functionally to the audit committee or board and administratively to senior management. This dual reporting is generally intended to preserve independence from the activities being audited while enabling day-to-day operation. The audit committee is often involved in appointing, evaluating, and, where relevant, removing the chief audit executive, and in approving the audit plan and budget. Precise arrangements depend on the entity's structure and applicable requirements, and this is not a substitute for tailored professional advice.

How is the annual internal audit plan typically developed?

Internal audit plans are commonly built using a risk-based approach, prioritizing areas of higher assessed risk relative to the organization's objectives, risk profile, and available resources. The process generally draws on the organization's risk assessment, input from management and the board, and consideration of prior findings and emerging risks. The plan is often reviewed and approved by the audit committee and revisited periodically as circumstances change. The appropriate methodology depends on the entity's context and the professional judgment of the chief audit executive.

How does internal audit coordinate with other assurance providers to avoid duplication?

Coordination is often approached through some form of assurance mapping, which seeks to identify who provides assurance over which risks across the lines of defense, including management functions, external audit, and specialist providers. The aim is generally to reduce gaps and unnecessary overlap while preserving internal audit's independence. Reliance on the work of others is typically evaluated for competence and objectivity before it is used. The extent and formality of coordination depend on the organization's size, complexity, and adopted framework.

How is the effectiveness of the internal audit function itself assessed?

Assessment approaches commonly combine ongoing internal monitoring, periodic internal self-assessments, and external quality assessments conducted by qualified, independent parties. Boards and audit committees often review the function's mandate, resourcing, independence, and the outcomes of its work. Some professional standards frameworks set expectations for such quality assessments, though their applicability depends on whether the function has adopted or is subject to them. This entry is educational and not a substitute for professional guidance tailored to the specific entity.

Common misconceptions

Internal audit owns and manages the organization's risks and controls.

Ownership of risks and the design and operation of controls generally rests with management (the first and second lines). Internal audit typically provides independent assurance over those controls and does not own them; assuming ownership would compromise its objectivity.

Internal audit and external audit perform the same function.

External audit generally provides an opinion on financial statements for external stakeholders and is engaged from outside the organization, while internal audit provides broader assurance on governance, risk, and controls to the board and management. Their scope, reporting audiences, and mandates differ, though they may coordinate.

A clean internal audit report means the organization faces no meaningful risk.

Internal audit provides assurance based on a risk-based, sampled scope at a point in time; it does not guarantee the absence of risk or the detection of all issues. Residual risk can remain even where controls are assessed as effective, and coverage is inherently limited.

Best practices

Maintain a board- or audit-committee-approved charter that clearly defines internal audit's authority, scope, and dual reporting lines, and review it periodically to preserve independence and objectivity.

Base the annual audit plan on a documented risk assessment, prioritize higher-risk areas, and have the plan approved by the audit committee with updates as the risk profile shifts.

Evaluate both control design and operating effectiveness distinctly in each engagement, and be explicit in reporting about which was tested and any limitations in scope or sampling.

Preserve functional reporting to the audit committee and administrative reporting to management, escalating significant matters directly to the committee to protect independence.

Track management's remediation of findings through a formal follow-up process, while keeping ownership of corrective action with management rather than internal audit.

Coordinate with other assurance providers, such as the second line and external audit, to reduce duplication and gaps, while clearly documenting the boundaries of each function's responsibilities.