Internal audit is an independent function inside a company that evaluates how well the organization manages risk, follows its own policies, and protects its assets. The Institute of Internal Auditors (IIA) defines it as “an independent, objective assurance and advisory service designed to add value and improve an organization’s operations” through a systematic approach to governance, risk management, and internal controls.1The Institute of Internal Auditors. Global Internal Audit Standards 2024 The team reports its findings to the company’s own leadership and board, not to outside investors. That distinguishes it from external auditing, which exists to give the public an opinion on the financial statements.
Where Internal Audit Sits in the Company
The clearest way to picture the role is the IIA’s Three Lines Model. The first line is the people running day-to-day operations. The second is functions like compliance, risk management, and quality assurance that help management monitor those operations. Internal audit occupies the third line, independently evaluating whether the first two are doing their jobs.2The Institute of Internal Auditors. The IIA’s Three Lines Model Internal audit doesn’t run anything and doesn’t own any controls. It assesses and advises.
Independence is what keeps the assessment honest. If the people being evaluated controlled the auditors’ budgets and jobs, the findings wouldn’t be worth much. The standard fix is a dual reporting structure: the chief audit executive (CAE) reports functionally to the audit committee of the board and administratively to the CEO or another senior executive.3U.S. Securities and Exchange Commission. NYSE Listed Company Manual – Audit Committee Requirements Functional reporting to the audit committee means the board oversees the audit plan, the budget, and the hiring and evaluation of the CAE, which keeps lower-level managers from burying unfavorable findings. Major stock exchanges require this kind of arrangement for listed companies.
The function’s authority comes from a written charter. This document, approved by the board, establishes why the department exists, what it can access, and what it’s responsible for. It gives auditors explicit permission to review any records, personnel, or locations they need. Without that, a department head could refuse to cooperate and be within their rights. The IIA’s Global Internal Audit Standards treat the charter as a foundational requirement.4The Institute of Internal Auditors. IPPF and Standards Documents
What Internal Auditors Actually Review
The work covers whatever risk the company faces. Auditors test whether financial reporting is reliable, whether departments spend budgets efficiently, whether data security actually stops unauthorized access, and whether the business complies with the regulations it’s subject to. The common thread is spotting weak controls before they turn into losses, lawsuits, or regulatory trouble.
Departments typically run several distinct engagement types, chosen based on which risk is being evaluated:
- Financial audits verify that accounting data is accurate and that financial statements follow generally accepted accounting principles (GAAP), which public companies must use when filing with the Securities and Exchange Commission.5Accounting Foundation. GAAP and Public Companies
- Operational audits examine whether specific departments or processes use resources efficiently. An audit of a warehouse, for example, might measure how much labor goes into fulfilling orders and compare that to industry benchmarks.
- Compliance audits check that the company follows applicable laws and regulations, often including the Sarbanes-Oxley Act of 2002 at public companies.
- Information technology audits evaluate data security, system access controls, backup procedures, and the integrity of digital infrastructure. As companies store more sensitive data electronically, IT audits have become one of the fastest-growing engagement types.
The categories overlap. A compliance audit tied to Sarbanes-Oxley will almost always touch financial reporting accuracy and IT controls at the same time. Experienced teams design engagements that cross categories when the risk calls for it.
How an Audit Works From Start to Follow-Up
Planning and Risk Assessment
Every engagement starts with defining the scope and objectives. The team performs a risk assessment to decide which controls to test. Strong audit departments use risk-based planning rather than a fixed annual rotation, ranking areas by the likelihood and impact of something going wrong. Processes that handle the most money, face the most regulatory scrutiny, or have changed recently rise to the top. When the business changes, so does the plan. A new subsidiary, a new market, or a new IT system moves those areas up in the queue.
Fieldwork and Evidence Gathering
Fieldwork is where auditors collect the evidence behind their conclusions. They review documents, observe processes, interview staff, and test transactions. Substantive testing checks the accuracy of individual transactions or large data sets against supporting documentation. Walk-throughs trace a single transaction end to end through every control point to see whether the process really works the way the policy says it does.
Data analytics has changed this phase. Rather than sampling a handful of transactions, auditors now routinely analyze 100% of a data set. Analytics tools flag anomalies like vendor addresses that match employee addresses, duplicate direct-deposit account numbers on payroll, or invoice number patterns that don’t follow Benford’s Law, a statistical distribution that legitimate numbers tend to follow. These techniques catch fraud and errors that sampling would miss entirely.
Reporting and Follow-Up
The team drafts a formal report summarizing findings and recommendations, usually with a risk rating on each finding so management knows what to prioritize. The report goes to the audit committee and the relevant executives, who agree on corrective actions and deadlines. The work isn’t finished there. Auditors follow up, typically within 60 to 90 days, to confirm that the agreed changes have actually happened. For complex fixes, the timeline stretches, but the monitoring continues. Without this stage, the same findings show up year after year.
The SOX Effect on Internal Audit
The Sarbanes-Oxley Act of 2002 shaped what internal audit looks like at public companies. Section 404 requires management to assess and report on the effectiveness of internal controls over financial reporting each year, and it requires an independent external auditor to issue a separate opinion on those controls. Internal audit departments typically perform much of the testing that supports management’s annual assessment, even though the statute doesn’t name them.
SOX also gave internal audit a role in whistleblower programs. Section 301 requires the audit committee to establish procedures for receiving and handling complaints about accounting irregularities, including confidential and anonymous submissions from employees.6PCAOB. Sarbanes-Oxley Act of 2002 At many companies, internal audit helps monitor that complaint pipeline, investigates tips, and reports substantiated findings to the board. The penalties for false certifications or ineffective controls, imposed by the Public Company Accounting Oversight Board (PCAOB) and the courts, run into millions of dollars and prison time for executives. Internal audit exists in part to keep those risks theoretical.
Fraud Detection
Internal auditors aren’t law enforcement, but they’re often the first to spot fraud. Routine testing of controls and transactions puts them in a position to notice unexplained journal entries, vendors that don’t seem to exist, or expense patterns that don’t match business activity. When something looks wrong, the response matters as much as the detection. Best practice calls for assembling a team that includes legal counsel, a forensic accountant, and IT forensics before anyone starts digging. Restricting the suspect’s access to company systems and preserving electronic evidence are early priorities.
Internal Versus External Auditors
The two functions serve different audiences and cover overlapping ground. External auditors issue opinions on financial statements for investors and regulators. Internal auditors evaluate the full range of operations for the board and management. Where the two coordinate well, the company gets better coverage without paying twice for the same work.
PCAOB Auditing Standard 2605 tells external auditors how to decide whether to rely on internal audit’s work. They evaluate the team’s competence, looking at education, professional certifications, and the quality of documentation. They also assess objectivity, including whether the CAE reports to someone senior enough that findings get taken seriously and whether the board oversees the CAE’s employment.7PCAOB. AS 2605 – Consideration of the Internal Audit Function When external auditors conclude they can rely on the internal team’s testing, the company avoids duplicating work and often reduces external audit fees.
Standards and Certification
Internal auditing follows a formal set of mandatory professional standards issued by the IIA. The current framework, the Global Internal Audit Standards, took effect in January 2025 and governs how audit functions worldwide plan, execute, and report. New mandatory topical requirements roll out through 2026, covering cybersecurity, third-party risk management, and organizational behavior governance.4The Institute of Internal Auditors. IPPF and Standards Documents The standards also require audit functions to maintain a quality assurance and improvement program, with ongoing internal monitoring and periodic external reviews to confirm conformance.
The primary credential in the field is the Certified Internal Auditor (CIA) designation, administered by the IIA. Candidates with a master’s degree need one year of relevant experience in internal audit, risk management, compliance, or a related field, plus passing all three exam parts within three years of applying. Bachelor’s degree holders need two years of experience and the same three-part exam. CPAs and CAs have their education and work experience requirements waived or reduced and can take a condensed challenge exam during specific testing windows. Candidates can sit for the exam before completing the experience requirement.8The Institute of Internal Auditors. Become a Certified Internal Auditor (CIA)