The Internal Audit Function: Scope, Independence, and Standards

The internal audit function is an independent group inside an organization that evaluates how well the company manages risk, follows its own policies, and protects its assets, reporting its findings to the board rather than to the managers whose work it reviews. After the corporate accounting scandals of the early 2000s, regulators and stock exchanges elevated this function into a cornerstone of corporate governance. The Institute of Internal Auditors (IIA) positions it as the “third line” of organizational defense, accountable directly to the board of directors.¹

Where It Sits in the Organization

The IIA’s Three Lines Model, updated in 2020, describes how governance responsibility is shared. The first line is operational management: the people who run business units, execute transactions, and own the controls that come with delivering products or services. The second line is specialized oversight, such as compliance, legal, risk management, and IT security, which sets policies and monitors whether the first line follows them. The third line is internal audit, which provides objective assurance to the board on whether the first two lines are doing their jobs.

Internal audit does not own any controls or manage any risks. Its value depends entirely on separation from the activities it reviews. When management runs a strong compliance and monitoring program, the audit team can scale back its detailed testing and focus on whether that monitoring is reliable. When oversight is weak, auditors pick up the slack with deeper and more frequent reviews.²

What Internal Auditors Actually Do

Assurance Work

The primary job is providing objective assurance that risk management and internal controls actually work. Auditors systematically review how risks are identified, assessed, and mitigated across business units to flag problems before they turn into financial losses or regulatory violations. They test the reliability of financial data, verify that physical and digital assets are safeguarded, and confirm that processes match stated policies.

Advisory Engagements

The department also acts as a consulting resource for leadership, recommending improvements to workflows and controls. There is a firm boundary here: auditors can suggest changes but cannot implement or manage them. The moment an auditor takes ownership of a process, they lose the ability to objectively evaluate it later. The IIA’s Global Internal Audit Standards make this distinction explicit, and it shapes how the function is structured throughout.³

Fraud Investigation

When potential fraud surfaces, internal audit typically leads or coordinates the initial response. A preliminary inquiry determines whether the facts point toward an actual violation or an honest error. If wrongdoing appears likely, a formal investigation follows, often involving legal counsel and sometimes law enforcement. Auditors preserve evidence, document each step, and maintain chain-of-custody procedures that hold up if the matter reaches litigation. Independence pays off most directly here: an investigation conducted by someone outside the affected department carries far more credibility with regulators, courts, and the board.

What the Function Covers

Financial Reporting and Sarbanes-Oxley

For publicly traded companies, verifying the accuracy of financial reporting dominates the audit workload. Section 404 of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of internal controls over financial reporting in every annual report, and an independent external auditor must separately evaluate that assessment.⁴ Internal audit plays a supporting role by testing controls throughout the year, feeding its findings into both management’s self-assessment and the external auditor’s review.

Cybersecurity Risk and SEC Disclosure

Cybersecurity has moved from an IT-department concern to a board-level disclosure obligation. SEC rules adopted in 2023 require public companies to disclose their processes for assessing and managing material cybersecurity risks in annual 10-K filings, including the board’s oversight role and management’s responsibilities. Companies must also report material cybersecurity incidents on Form 8-K within four business days of determining that the incident is material.⁵

Internal audit independently tests whether the cyber risk management processes and incident response plans actually function as described. Auditors evaluate access controls, encryption practices, disaster recovery protocols, and the process management uses to determine whether a breach is material. That materiality judgment matters enormously; a delayed or incorrect determination can trigger SEC enforcement action on top of whatever damage the breach itself caused.

Anti-Corruption and Operational Compliance

The Foreign Corrupt Practices Act requires every publicly traded company to maintain accurate books and records and to keep internal accounting controls strong enough to ensure transactions happen only with proper authorization, assets are properly tracked, and discrepancies are investigated.⁶ Auditors test these controls, particularly in procurement, international sales, and third-party agent relationships where bribery risk concentrates.

Auditors also cover operational areas beyond financial reporting. Human resources audits review hiring practices and payroll accuracy. Supply chain audits test vendor selection and contract compliance. A risk-based audit plan prioritizes these reviews so departments with the highest exposure to financial loss or regulatory action get the most frequent attention.

Continuous Auditing

Traditional auditing reviews a sample of transactions after the fact. Continuous auditing uses technology to test controls and flag anomalies in near-real time, letting the team report findings far faster than the traditional retrospective approach.²

Continuous auditing and continuous monitoring are not the same thing. Continuous monitoring is management’s own process for checking whether controls work day to day. Continuous auditing is the internal audit function’s independent use of similar technology to test those same controls. The ownership distinction matters: if audit adopts management’s monitoring tools without maintaining separation, the team risks losing objectivity over that process.

Independence and Reporting Structure

The Chief Audit Executive’s Dual Reporting Line

The Chief Audit Executive (CAE) reports functionally to the board of directors, or its audit committee, meaning the board approves the audit plan, receives findings directly, and oversees the CAE’s appointment and removal. Separately, the CAE reports administratively to the CEO or another senior executive for practical matters like budgets, office resources, and organizational status.³

The split exists because without direct board access, a CAE who discovers fraud or misconduct by senior management has nowhere safe to report it. The board’s control over hiring and removal protects the CAE from being fired for delivering unwelcome findings. In practice, the relationship works only if the audit committee actively engages with the CAE rather than receiving the annual report and moving on.

Audit Committee Requirements

For public companies, the audit committee itself must meet specific independence standards. Under SEC Rule 10A-3, every member must be an independent director. Independence means the member cannot accept consulting or advisory fees from the company beyond director compensation and cannot be an affiliate of the company or its subsidiaries.⁷

Federal law also requires companies to disclose whether at least one audit committee member qualifies as a “financial expert,” meaning someone with experience in accounting, auditing, or financial reporting at a comparable organization. If no member qualifies, the company must explain why.⁸ Without that expertise, an audit committee cannot really evaluate the work product it receives from internal and external auditors.

Safeguarding Objectivity

Beyond structural independence, the IIA standards address individual auditors. The core rule: auditors should not evaluate activities where they recently held operational responsibilities. If the CAE takes on temporary management responsibilities in a business area, an independent third party must oversee any assurance work in that area for at least 12 months afterward, though the CAE and board should evaluate whether 12 months is enough given the circumstances.³

The standards flag several situations that impair independence: management attempting to limit audit scope, restricting access to records or personnel, pressuring auditors to suppress findings, or cutting the audit budget to a level that prevents the function from fulfilling its charter. When an impairment is discovered after an engagement is already complete, the CAE must disclose it to the board, senior management, and affected stakeholders, and determine what corrective action is needed.

Whistleblower Protections for Audit Staff

Internal auditors occupy an unusual position under whistleblower law. Their job requires them to uncover problems, but the legal frameworks for reporting those problems treat audit personnel differently from ordinary employees.

Sarbanes-Oxley prohibits public companies from retaliating against any employee who reports conduct they reasonably believe violates securities fraud laws, SEC rules, or other federal anti-fraud provisions. Retaliation includes termination, demotion, suspension, threats, and harassment. The protection explicitly covers in-house accountants and auditors performing their normal duties.⁹ The standard is “reasonable belief”: the auditor need not prove a violation actually occurred or cite a specific statute, as long as the belief was held in good faith and was objectively reasonable.

The SEC’s Dodd-Frank whistleblower bounty program works differently. Employees whose primary job involves internal audit or compliance functions generally cannot qualify for financial awards, because information they gather through audit work does not count as “original information.” Three exceptions open the door:¹⁰

The auditor reasonably believes reporting to the SEC is necessary to prevent conduct likely to cause substantial financial injury to investors or the company.
The auditor reasonably believes the company is impeding an investigation of the misconduct.
At least 120 days have passed since the auditor reported the information internally to the audit committee, chief legal officer, chief compliance officer, or a supervisor, and the company has not acted.

The 120-day exception is the one most likely to apply in practice. An auditor who flags a problem through normal channels, watches the company ignore it for four months, and then goes to the SEC can qualify for an award even though the information came from audit work.

How the Function Is Evaluated

The 2024 Global Internal Audit Standards

The IIA replaced its previous framework with the 2024 Global Internal Audit Standards, which became mandatory on January 9, 2025.¹¹ They cover everything from how the CAE establishes the audit charter to how the department documents its work and communicates findings. An organization that claims conformance is expected to demonstrate it through a formal quality program, not just assert it.

Quality Assurance and Improvement Program

Every CAE must develop and maintain a Quality Assurance and Improvement Program (QAIP). It has two parts. First, ongoing internal assessments, including continuous monitoring and periodic self-evaluations, measure whether the department conforms to the standards and progresses toward its performance objectives. The CAE reports these results to the board and senior management at least annually, including any instances of nonconformance and the action plans to address them.¹²

Second, an external quality assessment must be performed at least every five years by a qualified reviewer with no ties to the organization.¹³ Internal self-assessments, no matter how rigorous, cannot fully substitute for an outside perspective. Results go directly to the board.

Performance Metrics and Credentials

Stakeholders track several quantitative metrics to gauge how the function performs. The most common are the percentage of the annual audit plan completed, the cycle time from fieldwork completion to issuing the final report, and the implementation rate of audit recommendations. That last one is the most telling. An audit department that issues brilliant reports nobody acts on isn’t adding value.

Evaluators also look at credentials. The Certified Internal Auditor (CIA) designation, administered by the IIA, is the most widely recognized credential in the field and signals that the holder has demonstrated competency across the full scope of internal audit practice.¹⁴ A department staffed primarily by certified professionals can tackle more complex engagements and carries more credibility with the board and external regulators than one that relies on general accounting or business backgrounds alone.

1
The Institute of Internal Auditors. The IIA’s Three Lines Model
2
The Institute of Internal Auditors. GTAG – Continuous Auditing: Coordinating Continuous Auditing and Monitoring to Provide Continuous Assurance
3
The Institute of Internal Auditors. Global Internal Audit Standards
4
Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
5
U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
6
Office of the Law Revision Counsel. 15 USC 78m – Periodical and Other Reports
7
U.S. Government Publishing Office. 17 CFR 240.10A-3 – Listing Standards Relating to Audit Committees
8
Office of the Law Revision Counsel. 15 USC 7265 – Disclosure of Audit Committee Financial Expert
9
Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
10
U.S. Securities and Exchange Commission. Regulation 21F – Securities Whistleblower Incentives and Protection
11
The Institute of Internal Auditors. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
12
The Institute of Internal Auditors. Quality Assurance and Improvement Program (QAIP)
13
The Institute of Internal Auditors. Quality Assessment Manual – Full External Assessment
14
The Institute of Internal Auditors. Certified Internal Auditor (CIA)