An internal audit is an independent review conducted by people inside your own organization to evaluate whether operations, financial reporting, and risk management are working the way they should. The Institute of Internal Auditors defines it as “an independent, objective assurance and advisory service designed to add value and improve an organization’s operations.”1The Institute of Internal Auditors. Global Internal Audit Standards 2024 Unlike an external audit, which reports to shareholders and regulators, an internal audit reports to your own board and management. The point is to catch problems before they become public failures.
What Internal Auditors Review
The scope is deliberately broad. An internal audit team can look at anything within the organization, and the best teams prioritize based on where the biggest risks sit. Most audit plans cover several recurring areas.
Operational Audits
Operational audits assess whether business processes are running efficiently. Supply chain management, human resources, procurement, manufacturing. Auditors look for bottlenecks, duplicated effort, and resource waste. These engagements often produce the most tangible results because findings translate directly into cost savings or productivity improvements.
Compliance Audits
Compliance audits verify that the organization is following applicable laws, regulations, and its own internal policies. Consequences of non-compliance vary by industry, but they can include financial penalties, loss of licenses, and reputational damage. Regulated industries like banking and healthcare tend to carry heavy compliance audit plans. Less regulated sectors may focus more on adherence to internal policy.
IT and Cybersecurity Reviews
Information security is one of the fastest-growing areas of internal audit work. The Government Accountability Office has flagged information security as a government-wide high-risk area since 1997, and the sophistication of attacks has escalated significantly since then.2Government Accountability Office. Cybersecurity Program Audit Guide Auditors in this space evaluate controls over system access, data protection, vulnerability management, and disaster recovery planning. For organizations subject to SOX requirements, reviewing IT controls is effectively mandatory because financial reporting depends on the integrity of the systems producing the data.
Financial Reporting Controls
Internal auditors test the controls that keep financial statements reliable. This work directly supports Section 404 of the Sarbanes-Oxley Act, which requires management to assess the effectiveness of internal controls over financial reporting every year.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls Internal audit teams typically run multiple rounds of testing throughout the year, building evidence that feeds into management’s annual assessment and the external auditor’s attestation.
ESG Assurance
Environmental, social, and governance disclosures are a growing area where internal audit adds value. As investors and regulators demand more reliable sustainability data, internal audit is well-positioned to provide assurance over ESG risk assessments and the controls behind published metrics.4The Institute of Internal Auditors. Internal Audit’s Role in ESG Reporting The function helps catch data quality problems before they end up in public reports.
How an Internal Audit Is Conducted
Internal audit work follows a four-phase cycle that repeats for each engagement. The phases are sequential, and cutting corners on earlier stages almost always creates problems later.
Planning and Risk Assessment
The cycle starts with a risk-based audit plan tied to the organization’s overall risk profile. IIA standards require the Chief Audit Executive to prioritize engagements based on the organization’s goals and risk exposures.5The Institute of Internal Auditors. On the Frontlines – The Risk-based Internal Audit Plan For each individual engagement, the team then defines specific objectives, scope, and testing procedures before fieldwork begins.
Fieldwork
This is where auditors apply their testing procedures and gather evidence. They interview people, observe processes, inspect documents, and re-perform transactions to verify that controls are working as designed. Control testing typically involves sampling: selecting a subset of transactions and checking whether each one followed the established procedure. The deviation rate tells the auditor whether a control is reliable or failing. Data analytics has changed this phase considerably. Auditors can now analyze entire populations of transactions rather than relying solely on samples, which makes it easier to spot anomalies that manual testing would miss.
Reporting
Findings from fieldwork are documented in a formal audit report covering the scope, methodology, specific control deficiencies, the associated risks, and recommendations for improvement. The most important part of any report is the management response, where the department responsible for the issue commits to specific corrective actions and target completion dates. Without that commitment, findings sit in a report and nothing changes. Strong audit functions negotiate realistic timelines and push back on vague commitments like “we’ll look into it.”
Follow-Up
The final phase tracks whether management actually implements the corrective actions they committed to. The audit team monitors progress and reports the status of open findings to the audit committee, with particular attention to items rated as high risk. If management knows nobody is checking, the urgency to fix issues evaporates quickly.
Who Internal Auditors Report To
Internal audit operates under a formal charter, typically approved by the board of directors or its audit committee. The charter spells out the department’s mission, scope, and authority, including unrestricted access to records, people, and physical locations needed to do its work.6The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success Without that access, auditors can’t do much.
Independence is what makes or breaks the function. Internal auditors don’t report to the managers whose work they’re reviewing. The head of internal audit, called the Chief Audit Executive or CAE, reports administratively to executive management and functionally to the audit committee of the board. That dual structure exists for a reason: the CAE needs to be able to surface uncomfortable findings without the person responsible for the problem controlling their career. The audit committee holds authority over the CAE’s pay, performance evaluation, and removal, which keeps the relationship honest.6The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success
The CAE meets privately with the audit committee on a regular basis. This is where governance concerns and significant control weaknesses get communicated at the highest level, away from managers who might prefer those issues stay quiet. Under SEC rules, the audit committee itself must consist of independent members, and it holds direct responsibility for overseeing the external auditors as well.7U.S. Securities and Exchange Commission. Standards Relating to Listed Company Audit Committees
The work itself is governed by the Global Internal Audit Standards, issued by the IIA and mandatory for all internal audit functions. The current version, effective since 2024, is organized into five domains covering the purpose of internal auditing, ethics and professionalism, governing the function, managing it, and performing audit work.8The Institute of Internal Auditors. Global Internal Audit Standards The IIA’s Code of Ethics builds on four principles: integrity, objectivity, confidentiality, and competency.9The Institute of Internal Auditors. IIA Code of Ethics Objectivity gets the most attention in practice. If an auditor previously managed the process they’re now reviewing, that’s a conflict, and the standards require disclosure and reassignment.
Internal Audit vs. External Audit
People confuse these two constantly. They share the word “audit” and sometimes overlap in their work, but they serve different purposes, answer to different audiences, and operate under different rules.
Audience and Scope
Internal audit reports to the organization’s own board and management. Its scope is broad: operational efficiency, compliance, IT governance, risk management, fraud prevention, and anything else the audit plan identifies. External audit reports to outside parties, meaning shareholders, creditors, and regulators. Its scope is narrow, focused primarily on whether the financial statements are presented fairly in accordance with Generally Accepted Accounting Principles.10Public Company Accounting Oversight Board. AS 3101 – The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion An external auditor might never look at your supply chain efficiency or your cybersecurity posture unless those issues affect the financial statements.
Legal Weight
Public companies must file annual reports containing audited financial statements certified by independent public accountants under Section 13(a) of the Securities Exchange Act.11Office of the Law Revision Counsel. 15 USC 78m – Periodical and Other Reports The external audit opinion carries legal weight for investors who rely on it when making investment decisions. Internal audit reports, by contrast, are internal documents. They carry organizational weight and inform governance decisions, but they don’t have the same legal standing with outside parties.
Independence
Both functions require independence, but the concept plays out differently. Internal auditors are employees of the organization, independent of the departments they review but not of the organization itself. External auditors must be completely independent third-party firms. The audit committee is directly responsible for appointing, compensating, and overseeing the external auditors, and strict rules prohibit the kinds of consulting relationships that could compromise objectivity.7U.S. Securities and Exchange Commission. Standards Relating to Listed Company Audit Committees
Coordination
Internal and external auditors often coordinate their work. Under the PCAOB’s integrated audit standards, external auditors plan their testing of internal controls alongside their financial statement audit.12Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting When internal audit has already tested a control and documented the results, external auditors may evaluate that work and factor it into their own assessment. This reduces duplicated effort, but external auditors can never fully substitute internal audit’s testing for their own.
When an Internal Audit Function Is Required
Internal audit is sometimes described as voluntary, but that characterization is misleading for many organizations. Several regulatory and listing requirements effectively mandate the function.
Stock Exchange Listing Rules
The NYSE requires all listed companies to maintain an internal audit function. Companies going through an initial public offering get a one-year transition period from their listing date to comply. The audit committee charter must describe the committee’s role in overseeing the internal audit function, and the committee is required to meet periodically with the internal auditors.13U.S. Securities and Exchange Commission. NYSE Listed Company Manual
Sarbanes-Oxley
Section 404 of the Sarbanes-Oxley Act requires management of public companies to include an internal control report in every annual filing. That report must state management’s responsibility for maintaining adequate controls over financial reporting and include an assessment of those controls’ effectiveness.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls For large accelerated and accelerated filers, the external auditor must also attest to management’s assessment, which effectively requires an integrated audit of both the financial statements and internal controls.12Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting Smaller issuers are exempt from the external attestation requirement, though they still must perform management’s own assessment. SOX doesn’t explicitly require an internal audit department, but performing the testing needed for these assessments is extremely difficult without one.
Banking and Financial Institutions
Financial institutions face the most explicit regulatory expectations. The Federal Reserve’s supplemental policy statement applies to supervised institutions with more than $10 billion in total consolidated assets and identifies an independent internal audit function as essential for institutional safety and soundness.14Federal Reserve. Internal Audit Function and Its Outsourcing – Supplemental Policy Statement The Fed considers the quality of an institution’s internal audit function when conducting supervisory assessments and deciding how much to rely on the institution’s own work.
Organizations outside these rules can still choose to build an internal audit function, and many do once they reach a size where management can no longer have personal visibility into every risk. The regulatory requirements set the floor, not the ceiling.