What is internal audit?
Internal audit is an independent function within an organisation that reviews how well its risks are managed, its controls work and its governance operates, and reports to the board or audit committee. Unlike external audit, which gives an opinion on the financial statements for shareholders, internal audit serves the organisation and can cover any area.
Also calledinternal auditingIAthird line
Compare the softwareBest audit software →All 8 audit vendors →
- Reports to
- Audit committee
- Standards
- IIA Global Internal Audit Standards
- Scope
- Risk, controls, governance
How internal audit works
The function sets a risk-based audit plan, usually yearly and approved by the audit committee, covering areas such as financial controls, IT, procurement, compliance and operations. Each audit scopes the risks, tests controls through walkthroughs, sampling or data analytics, and reports findings with agreed actions, which are then followed up. To stay independent, the head of internal audit reports functionally to the audit committee rather than to the managers being audited. The Institute of Internal Auditors' Global Internal Audit Standards, in effect since 9 January 2025, set the professional framework. In listed US companies internal audit often supports management's testing of internal control over financial reporting under SOX. Data analytics lets internal auditors test whole populations of transactions; Workiva supports controls testing and audit management, and MindBridge scores transactions for risk.
Common questions
What is the difference between internal and external audit?+
External auditors are independent firms that give an opinion on the financial statements for shareholders. Internal auditors work for the organisation, often as employees, and review risks and controls across the business for the board.
Is internal audit required by law?+
Not for most companies. Some sectors and listing rules require or expect one; for example, NYSE-listed companies must have an internal audit function, and banks and insurers are expected to.
What does internal audit do for SOX?+
It often tests key financial controls on behalf of management, documents the results and supports the external auditor, while remaining independent of the processes it tests.
Internal audit software
Part of Accountio’s accounting technology coverage · Glossary
