What it means
People often confuse internal audit with the external audit that produces an opinion on the financial statements. External audit looks backwards at whether the accounts are fairly stated, while internal audit looks at anything that could hurt the organisation, from purchasing fraud and IT access rights to health and safety and supplier contract compliance.
Independence is the whole point of the function. If internal audit reported to the finance director, it could hardly write a critical report about the finance department, which is why the head of internal audit normally has a direct line to the audit committee chair.
Work is planned around risk rather than around a fixed rota. The team builds an annual plan that puts the most time into the areas where the combination of likelihood and potential damage is greatest, then agrees that plan with the audit committee so priorities are visible and deliberate.
A typical assignment follows a familiar shape: agree the scope, test what actually happens against what the policy says should happen, discuss findings with management, then issue a report with rated recommendations and agreed owners and deadlines. Following up on whether those actions were completed is at least as valuable as the original review.
Smaller organisations often outsource or co-source the function, buying in specialist days rather than employing a full team. The value case is usually framed in terms of losses recovered, losses avoided and control weaknesses fixed before they became expensive.
Reports normally rate findings so that attention lands where it belongs. A high-rated finding means an exposure the board needs to know about now, while a low-rated one is a housekeeping point, and rating everything as urgent quickly trains managers to ignore the whole document.
In practice
Real-world examples
Example 1
A hotel group's internal audit team tests whether refunds over $500 are genuinely being approved by a second person, and finds that in one region the same manager both raises and approves them. The finding leads to a system change that enforces the split automatically, and a follow-up review three months later confirms the fix has held.
Example 2
A charity's internal auditor reviews grant spending against donor restrictions and identifies $120,000 spent from a restricted fund on general overheads. The error is corrected before the annual report is published, avoiding a difficult conversation with the funder.
Example 3
A logistics company uses internal audit to review its new warehouse management system three months after go-live. The review finds that 40% of stock adjustments are being posted without a reason code, which explains a stubborn inventory discrepancy.
Think of it
An internal audit is like having a friendly health check-up with your GP. The doctor runs tests not to punish you, but to spot early warning signs and help you make healthier lifestyle choices before a small issue becomes a serious illness.
Formula
Calculation
Internal audit return on investment = (Recoveries + Quantified avoided losses) / Cost of the internal audit function
A retail group spends $480,000 a year on its internal audit team. During the year its reviews identify $900,000 of duplicate supplier payments and pricing errors that are recovered from vendors, plus $300,000 of quantified losses avoided by closing a gap in stock write-off approvals. Total benefit is $900,000 + $300,000 = $1,200,000, net benefit is $1,200,000 - $480,000 = $720,000, and the return is $1,200,000 / $480,000 = 2.5 times the cost.Case study
Seen in the real world
Calder Utilities Group is an invented company used purely for this illustrative case. It had grown by acquiring four regional maintenance firms and had never formalised how subcontractor invoices were approved, since each acquired business kept its own habits.
The newly appointed head of internal audit sampled 200 subcontractor invoices across the group. In one subsidiary, 31 of the 50 sampled invoices had no matching purchase order and were approved by a single supervisor, and three subcontractors were being paid rates 20% above the framework agreement.
The report went to the audit committee with four rated recommendations and named owners. Within six months the group had standardised approval limits, recovered $210,000 in overcharges and moved all four subsidiaries onto one purchase order system. The illustrative point is that internal audit earns its budget by finding the things nobody had thought to look for.
Watch out
Common mistakes
- Treating internal audit as an extension of the external auditors, when the two have different reporting lines, different scopes and different purposes.
- Letting internal audit report to the executives whose areas it reviews, which destroys the independence that makes its findings credible.
- Judging the function by the number of reports issued rather than by whether the agreed actions were actually completed.
Questions
People also ask
Is internal audit legally required?
It is mandatory in some regulated sectors and for many listed companies, but many private businesses adopt it voluntarily as good governance.
Can internal audit design the controls it later tests?
Best practice says no, because reviewing your own work removes the independence the role depends on.
What is the difference from a compliance function?
Compliance builds and runs the rules day to day, while internal audit independently checks that those rules are working.