Internal Audit

Boards and executives rely on many people to run the organization well, but they need an independent way to check whether that is actually happening. Internal audit provides it. Internal auditors review how processes, controls and risk management work in practice, compare what they find with policies and expectations, and report gaps and recommendations. Unlike external auditors, who focus on giving an opinion on the financial statements, internal auditors can examine any part of the organization, from cybersecurity and supply chains to culture and major projects. This breadth makes internal audit one of the few functions with a view across the whole organization.

Most large organizations have an internal audit function, and many stock exchanges and regulators expect or require one. In the United States, the New York Stock Exchange requires listed companies to maintain an internal audit function, and banking regulators set detailed expectations for banks. The Institute of Internal Auditors sets global standards for the profession, most recently through the Global Internal Audit Standards that took effect in January 2025. For risk, compliance and finance leaders, internal audit is a source of objective assurance and a partner in improving how the organization is controlled.

Definition of Internal Audit

Internal audit is an independent and objective assurance and advisory activity that helps an organization achieve its objectives by evaluating and improving the effectiveness of governance, risk management and control processes using a systematic, disciplined approach.

It acts as the third line in the three lines of defense model, tests internal controls and often supports SOX compliance testing in public companies.

What Internal Audit Covers

Financial audits review controls over accounting, financial reporting and the safeguarding of assets.

Operational audits look at whether processes are efficient, effective and well controlled, such as procurement, payroll or customer onboarding.

Compliance audits test whether the organization is meeting laws, regulations, contracts and internal policies.

IT and cybersecurity audits review system access, change management, data protection, resilience and the security of key applications.

Advisory work, such as reviewing the design of a new system or process before it goes live, helps build controls in from the start. Advisory work must be managed carefully so it does not compromise the function's independence.

Independence and Reporting Lines

Internal audit's value depends on its independence from the activities it reviews.

The chief audit executive usually reports functionally to the audit committee, which approves the audit plan, budget and the chief audit executive's appointment.

Administratively, the function typically reports to the chief executive or chief financial officer for day-to-day matters.

Internal auditors should not design or run the controls they audit, since that would mean reviewing their own work. Rotating auditors across areas also helps keep their judgment fresh.

Importance of Internal Audit in Risk and Compliance

Internal audit gives objective assurance. Boards and audit committees receive an independent view of whether risks are managed and controls work, rather than relying only on management's own reports.

It finds problems early. Audits often uncover control gaps, inefficiencies and compliance issues before they cause losses, fines or misstated results.

It also drives improvement. Audit recommendations, tracked through to completion, push the organization to fix root causes rather than symptoms. Over time, recurring themes across audits can point to wider weaknesses in culture or governance.

Internal Audit and Financial Management

Internal audit tests controls over revenue, payments, payroll and the general ledger, supporting reliable financial reporting.

When internal audit's testing is of good quality, external auditors may rely on some of it, which can reduce external audit fees. Coordinating the two audit plans also reduces duplicate requests to the business.

Audits frequently identify savings, such as duplicate payments, unused licenses, contract overcharges and inefficient processes.

The audit function has its own budget, so audit plans should focus resources on the areas of highest risk and value.

Common Challenges

Audit plans built from a fixed rotation of areas can miss new and fast-changing risks. Areas such as artificial intelligence, cloud services and third parties may change faster than a three-year cycle can follow.

Findings may be accepted but not fixed, leaving the same issues to reappear in later audits.

Relationships with management can become adversarial if audits are seen as fault-finding rather than as a way to improve. Sharing draft findings early and agreeing facts before reports are issued helps keep relationships constructive.