Internal audits should be performed by people who are structurally independent from the operations they review. In practice, that means one of four arrangements: a dedicated in-house internal audit department, an external firm hired under contract, a co-sourced model that combines both, or subject matter experts pulled temporarily from other departments to serve as guest auditors. Which arrangement fits depends on your size, industry, and regulatory exposure, but the question of who should perform an internal audit always comes back to the same test: is the auditor free from the people and processes being examined?
Why Independence Decides Everything
The Institute of Internal Auditors (IIA) publishes the Three Lines Model, which places internal audit in the third line, separate from operational managers (first line) and from oversight functions like compliance and risk management (second line). Internal audit’s purpose is to give the governing body — usually the board or its audit committee — assurance that carries more objectivity than anything management can produce about itself.1The Institute of Internal Auditors. The IIA’s Three Lines Model – An Update of the Three Lines of Defense
That independence rests on three protections: the audit function reports to the governing body rather than to management, it has unrestricted access to people and records, and it plans and executes its work without interference.1The Institute of Internal Auditors. The IIA’s Three Lines Model – An Update of the Three Lines of Defense The rule has a sharp practical edge for smaller organizations. If your chief audit executive also holds a management role, the function is no longer independent for the areas that role touches, and assurance over those areas has to come from a qualified outsider. Most independence failures start here: one person wearing two hats and believing they can be objective about their own work.
A Dedicated In-House Audit Department
The cleanest arrangement is a permanent internal audit team inside the organization but separate from the departments it reviews. The chief audit executive reports functionally to the audit committee of the board, not to the CEO or CFO. That reporting line is the single most important structural protection against management shaping what gets audited or how findings get told.
In-house teams work from a risk-based audit plan approved by the board, covering financial, operational, and compliance risks. They review sensitive material like general ledgers, payroll data, and procurement contracts. Because they are permanent, they build deep familiarity with the company’s systems, culture, and recurring problem areas. That institutional knowledge is a genuine edge over outside auditors who need weeks to learn how things work before they can judge whether they work correctly.
The board’s oversight responsibilities include hiring and firing the chief audit executive, approving and funding the audit plan, receiving audit reports, and giving the chief audit executive private access without management present.1The Institute of Internal Auditors. The IIA’s Three Lines Model – An Update of the Three Lines of Defense When boards delegate those decisions to management, audit functions tend to lose their edge. Reports get softened and uncomfortable findings get deprioritized.
External Firms and Co-Sourced Teams
Organizations that lack the budget or headcount for a full department hire outside firms instead. These providers sign engagement letters defining scope, timeline, and the specific controls they will examine. They bring an outside perspective free of internal politics, plus tools and methodologies developed across many clients.
Two models exist here. In full outsourcing, the external firm runs the entire internal audit function. In co-sourcing, the outside firm supplies staff and specialized expertise that plug into an existing internal team while decision-making authority stays with the organization. Co-sourcing is more common at mid-sized companies because it fills skill gaps — cybersecurity, data analytics, industry-specific regulation — without giving up control over audit priorities.
One restriction applies to both models. The firm doing your internal audit work should not be the same firm that audits your financial statements. Using one firm for both destroys the independence that makes either engagement meaningful.2The Institute of Internal Auditors. Staffing Considerations for Internal Audit Activity
Fees vary widely with complexity, industry, and consultant seniority. When comparing proposals, look at what deliverables are actually included, how the firm handles findings that implicate senior management, and whether the engagement letter preserves the audit committee’s authority over scope changes.
Guest Auditors From Inside the Business
The guest auditor model borrows employees from operational departments to work on specific audits for a limited time. An IT security specialist might examine firewall configurations during a cybersecurity audit; a facilities engineer might evaluate safety protocols at a manufacturing site. These people bring technical depth that a general auditor would need months to develop.
Because guest auditors are not professional auditors, the arrangement needs structure. Their responsibilities, authority, and time commitment are usually formalized in a project-based agreement between the chief audit executive and the department head. They follow the established audit program, document findings in the standardized format, and return to their regular jobs when the engagement ends.
The obvious limitation is independence. A guest auditor pulled from IT to review IT controls is evaluating their own colleagues’ work. Use guest auditors for technical validation rather than for judgments about control effectiveness. They answer “is this firewall configured correctly?” while a professional auditor answers “is the organization’s approach to network security adequate?”
Qualifications To Require
Whichever staffing model you choose, the people doing the work should be measured against the IIA’s Global Internal Audit Standards, a mandatory component of the International Professional Practices Framework.3The IIA. IPPF and Global Internal Audit Standards Two certifications dominate the profession.
The Certified Internal Auditor (CIA) is the IIA’s flagship credential. Candidates with a bachelor’s degree need two years of experience in internal audit, risk management, compliance, or a related field; those with a master’s degree need one year. All candidates must pass a three-part exam within three years of entering the program, and they can sit for the exam before completing the experience requirement.4The IIA. Become a Certified Internal Auditor (CIA)
The Certified Information Systems Auditor (CISA), administered by ISACA, is the credential for technology and information security auditing. CISA candidates need five years of professional experience in information systems auditing, control, or security, accumulated within the ten years before applying. The exam can be taken earlier, but certification is not granted until the experience requirement is met.5ISACA. Earn a CISA Certification
Credentials are not one-and-done. Holding a CIA requires 40 hours of continuing professional education each year.6The IIA. CPE Requirements – Maintain Your IIA Certification Financial rules, cyber threats, and governance expectations move constantly, and an auditor who stops learning becomes a liability.
At the function level, the IIA requires an external quality assessment of the internal audit activity at least once every five years. These reviews are performed by qualified, independent assessors from outside the organization who evaluate conformance with professional standards. The chief audit executive can opt for a full external assessment or an independent validation of a self-assessment done internally.7The Institute of Internal Auditors. Quality Assessment Manual for the Internal Audit Activity – Chapter 2 If you are hiring an external firm, ask when its last quality assessment occurred and what it found.
The Charter That Gives Auditors Authority
Whoever performs the work needs formal authority to do it. That authority comes from the internal audit charter, a document approved by the governing body that defines the audit function’s purpose, scope, and powers. Without a charter, auditors have no enforceable right to access records, interview employees, or enter facilities.
IIA guidance sets a minimum: a charter must define the function’s purpose, authority, responsibility, and position within the organization. The access provision is the clause that matters most in practice. The charter should grant “free and unrestricted access to all functions, records, property, and personnel pertinent to carrying out any engagement.”8The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success If a department can refuse to hand over documents or make staff available, the audit function cannot do its job. Vague access language is barely better than no charter at all.
Public Company Requirements
Publicly traded companies carry federal obligations that shape internal audit staffing directly. Under the Sarbanes-Oxley Act of 2002, Section 302 requires the CEO and CFO to personally certify in each annual and quarterly report that they are responsible for internal controls, that they have evaluated control effectiveness within 90 days of the report, and that they have disclosed their conclusions. Section 404 requires management to publish an annual assessment of internal controls in the annual filing. Internal auditors at public companies spend much of their time testing those controls so that the assessment has a factual basis. The penalties under Section 906 for knowingly or willfully certifying non-compliant reports run into millions of dollars and years of imprisonment.9Office of the Law Revision Counsel. 18 U.S.C. 1350 – Failure of Corporate Officers To Certify Financial Reports
Sarbanes-Oxley also protects the auditors themselves. Covered companies may not fire, demote, suspend, threaten, or otherwise retaliate against an employee who reports conduct they reasonably believe violates securities fraud laws or SEC regulations, whether the report goes to a federal agency, to Congress, or to a supervisor. An employee who prevails in a retaliation claim is entitled to reinstatement, back pay with interest, and litigation costs including attorney fees. Those rights cannot be waived by employment agreement, and no pre-dispute arbitration clause can force a retaliation dispute out of court.10U.S. Department of Labor. Sarbanes-Oxley Act (SOX)
For companies with international operations, internal audit has traditionally devoted significant resources to the Foreign Corrupt Practices Act, which prohibits paying or offering anything of value to foreign officials to secure business advantages.11Office of the Law Revision Counsel. 15 U.S.C. 78dd-1 – Prohibited Foreign Trade Practices by Issuers The enforcement picture shifted in 2025. Executive Order 14209 directed the Department of Justice to pause new FCPA investigations and issue updated guidelines, and the resulting DOJ guidance effective June 2025 narrowed enforcement to cases involving substantial bribes, sophisticated concealment, and ties to cartels or transnational criminal organizations, while deprioritizing routine business courtesies and low-dollar payments.12U.S. Department of Justice. Guidelines for Investigations and Enforcement of the Foreign Corrupt Practices Act The statute itself has not been repealed, so companies remain subject to its requirements, and internal audit teams may want to recalibrate resource allocation against the residual civil litigation and reputational exposure rather than assume federal enforcement is gone.