What it means
The department is normally led by a chief audit executive with a direct reporting line to the audit committee and an administrative line to the chief executive or chief financial officer. That split is deliberate, because it keeps the team funded and connected without letting management decide what does and does not get examined.
The work usually spans financial controls, operational efficiency, regulatory compliance and technology. A single year's plan might include a review of procurement approvals, a check on how a distribution centre counts stock and an assessment of who holds administrator rights in the payroll system.
An audit department is not the external auditor and does not sign the accounts. External auditors may rely on some internal audit work to reduce their own testing, but only after assessing the team's competence, objectivity and working methods.
Size is generally benchmarked against revenue, headcount and risk profile rather than any fixed rule. A mid-sized group might run a department costing somewhere between 0.1% and 0.3% of revenue, with regulated sectors sitting well above that range and simple businesses below it.
The department's real currency is credibility rather than authority. A team that surfaces problems long after the damage is done gets quietly ignored, whereas one that helps design controls before a new system goes live earns the access and candour it needs to be useful.
In practice
Real-world examples.
Example
A hotel group's audit department reviews cash handling at 30 properties over two years and finds that the same reconciliation step is skipped at seven sites. The recommendation is a single change to the nightly closing procedure rather than thirty separate action plans.
Example
A manufacturer's audit department is asked by the audit committee to review a proposed enterprise system before go-live rather than after. The team identifies that the new approval workflow would let one person raise and approve the same purchase order, and the configuration is changed before any transaction is processed.
Example
A bank with heavy regulatory obligations runs an audit department of 60 people, roughly triple what its revenue alone would suggest. The extra headcount exists because the regulator expects independent annual assurance over specific control areas regardless of the bank's own risk assessment.
Formula
Calculation
Audit department cost = (number of full-time equivalents x average fully loaded cost) + non-payroll costs
Cost as a percentage of revenue = department cost / revenue
Engagements per year = productive audit days / average days per engagement
A group with revenue of $650,000,000 runs an audit department of 8 full-time equivalents at an average fully loaded cost of $140,000 each.
8 x $140,000 = $1,120,000 of payroll cost.
Non-payroll costs, covering data analytics tools, training, travel and specialist co-source support, come to $180,000.
Total department cost = $1,120,000 + $180,000 = $1,300,000.
$1,300,000 / $650,000,000 = 0.20% of revenue.
Capacity works out as follows. The chief audit executive spends 60% of the year on committee reporting, planning and stakeholder work, so productive audit capacity is 7 full-time equivalents plus 0.4, giving 7.4.
7.4 x 200 available audit days each = 1,480 productive audit days.
At an average of 60 days per engagement, 1,480 / 60 = 24.7, so the department can deliver about 24 engagements a year.
Cost per engagement = $1,300,000 / 24 = roughly $54,200.Case study
Seen in the real world.
Kestrel Logistics Group is a fictional freight business invented for this illustration. For years its two-person audit department reported to the finance director, produced reports that circulated only within finance, and was widely described inside the business as an extension of the accounts team.
When a new audit committee chair arrived, she asked one question that changed the setup: who decides what gets audited. The answer was that the finance director approved the plan, which meant no review of the finance function itself had ever been proposed, let alone performed. The reporting line moved so that the head of audit reported functionally to the audit committee, with the finance director retaining only administrative oversight.
Over the following two years the department grew to five people and its first plan under the new structure included the areas nobody had previously chosen: fuel card spending, subcontractor haulier approvals and the treasury payment run. Two findings led to significant process changes. In this illustrative case, the department's effectiveness was determined almost entirely by who it reported to rather than by how skilled its people were.
Watch out
Common mistakes.
- Having internal audit report to the finance director. The team then cannot credibly review the finance function, and its independence is compromised in exactly the area where most control risk sits.
- Using the audit department as spare project resource. Every hour spent implementing a system is an hour not spent providing assurance, and it prevents the team from later auditing work it helped build.
- Judging the department by the number of reports it issues. Volume says nothing about whether the areas reviewed were the ones that mattered or whether anything actually changed afterwards.
Questions
People also ask.
What is the difference between an audit department and external auditors?
The audit department is an internal function serving the board across all types of risk, while external auditors are an independent firm giving an opinion on the financial statements to shareholders.
Should a small company have an audit department?
Usually not as a standing team, and many mid-sized businesses instead buy periodic internal audit reviews from an outside firm that is not their external auditor.
Who decides the annual audit plan?
The chief audit executive proposes it based on a risk assessment, and the audit committee approves it, which is what stops management filtering out inconvenient areas.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related