Internal audit is the function inside an organization that gives the board and senior management an independent, evidence-based view of whether risks are being managed, controls are working and the organization is run the way its policies and the law say it should be, and then helps it get better. It is staffed by the organization’s own people (or by a firm working for the organization under the audit committee’s direction), it reports to the board’s audit committee rather than to the managers it reviews, and it is governed by a professional framework, the Global Internal Audit Standards, that defines what it must do and how. The Standards’ own purpose statement puts it in six words that every auditor learns: assurance, advice, insight and foresight, delivered independently, to strengthen the organization’s ability to create, protect and sustain value.
This guide explains internal audit from the ground up for someone meeting it for the first time: a new auditor, a manager about to be audited, a board member who has just joined an audit committee, or a student deciding whether the profession is for them. It covers what the function is and what it is not, the objectives it exists to meet, who it serves and how it reports, the kinds of work it performs, the seven-stage process every engagement follows with a worked example, forty key terms defined plainly, how the function creates value and how that is measured, the standards and bodies behind it, and the misconceptions that cause the most friction. The what internal audit means guide covers the history and the vocabulary in more depth; the step-by-step process guide takes the seven stages one at a time; the jargon glossary defines 120 terms.
In this guide
- Internal audit defined
- The objectives of internal audit
- What internal audit is not
- Who internal audit serves and how it reports
- The three kinds of work
- The process in seven stages
- A worked example: one engagement, start to finish
- Forty key terms, defined
- How internal audit creates value, and how to measure it
- The standards and bodies behind the profession
- Misconceptions that cause friction
- Questions people ask about internal audit
- Related guides
Internal audit defined
The profession has used two formal definitions in the last decade, and both are worth knowing because both are still quoted. The 2017 International Standards defined internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations, which helps the organization accomplish its objectives through a systematic, disciplined approach to evaluating and improving risk management, control and governance. The Global Internal Audit Standards, published by the Institute of Internal Auditors in January 2024 and effective since January 2025, replaced the definition with a purpose statement (Domain I): internal auditing strengthens the organization’s ability to create, protect and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight. The Domain I guide explains why the wording changed.
Four words in those definitions carry the whole idea. Independent: the function is positioned outside the activities it audits, reporting to the board, so that its conclusions are not shaped by the people they concern. Objective: individual auditors form judgments on evidence rather than on relationships or pressure. Assurance: the core product is a conclusion the board can rely on, reached by testing. Risk-based: attention goes where the risk is, not evenly across everything. Everything else in the function, from the charter to the work program to the report, exists to make those four words true in practice.
The objectives of internal audit
Objectives are the test of whether a function is doing its job, and most audit charters state some version of the seven in the table. Each has a plain meaning, an example and the question the audit committee can ask to see whether it is being met.
| Objective | What it means | Example | The committee’s question |
|---|---|---|---|
| Provide assurance on risk management | Confirm that the organization identifies, assesses and responds to its significant risks | Auditing the enterprise risk management program and the risk register that feeds the board | Are the risks on our register the real ones, and are the responses working? |
| Provide assurance on controls | Test whether the controls over processes, finances, compliance and systems are designed well and operating | A procure-to-pay audit testing approvals, three-way matching and vendor master changes | Where are controls failing, and what has it cost us? |
| Provide assurance on governance | Evaluate whether decision-making structures, ethics, accountability and reporting work as designed | Reviewing how the board receives information and how conflicts of interest are handled | Do we actually know what is happening below us? |
| Safeguard assets and detect fraud exposure | Assess the controls that protect assets and the organization’s ability to prevent and detect fraud | Analytics across payments and payroll for duplicates, ghost employees and fictitious vendors | Where could someone take money from us without being noticed? |
| Verify compliance | Confirm adherence to laws, regulations, contracts and the organization’s own policies | Independent testing of an anti-money-laundering program | Will a regulator or a court find something we did not? |
| Improve operations | Identify inefficiency, duplication and missed opportunity, and recommend improvements | Finding that invoices are paid early and early-payment discounts are never taken | What is the function saving or earning us? |
| Advise and inform | Give management and the board advice, insight into patterns and foresight about emerging risks | Advising on controls for a new system before it goes live; a thematic report on a risk appearing across units | What should we be worrying about next? |
The last objective is where the 2024 Standards shifted emphasis. Assurance remains the core, but insight and foresight were added to the purpose statement because boards increasingly want the function to tell them not only what went wrong last quarter but what the pattern across engagements says and what is coming. The KPI guide shows how functions measure each objective.
What internal audit is not
Most confusion about internal audit comes from the four functions it is mistaken for. Each exists in most large organizations, each tests or manages controls, and each has a different mandate, reporting line and product. The four-functions guide treats the distinctions in detail; the summary is in the table.
| Function | Who it works for | What it answers | How it differs from internal audit |
|---|---|---|---|
| External audit | Shareholders, through the audit committee; appointed from outside | Are the financial statements fairly presented? (and for larger US public companies, is control over financial reporting effective?) | Narrow scope (the financial statements), an opinion once a year, a firm not an employee; internal audit covers all risks and operations year-round. The internal vs external audit guide compares them |
| Compliance | Management (second line) | Are we meeting our legal and regulatory obligations? | Owns and runs the compliance program; internal audit tests whether that program works. The internal audit vs compliance guide |
| Risk management (ERM) | Management (second line) | What are our risks and how are we responding? | Owns the risk framework, register and appetite; internal audit assures the framework and audits the ERM program itself |
| SOX / internal control over financial reporting | Management, for the CEO and CFO certifications | Are the key financial reporting controls effective at year end? | A management assessment under Section 404 that internal audit often supports but does not own; the SOX 404 guide |
| Management’s own monitoring | Line management (first line) | Is my process working today? | Supervision, reconciliations and reviews performed by the people who own the process; internal audit relies on it only after testing it |
The organizing idea behind the table is the Three Lines Model: management owns and manages risk (first line), specialist functions such as risk and compliance oversee and support (second line), and internal audit provides independent assurance over both (third line), reporting to the governing body. Internal audit is the only one of the five whose primary reporting line is to the board rather than to management, and that single fact explains most of what follows.
Who internal audit serves and how it reports
Internal audit has two masters by design, and the Standards describe the arrangement precisely. Functionally, the chief audit executive (the head of the function, whatever the local title) reports to the board, usually through its audit committee: the committee approves the charter, the risk-based plan and the budget, hires and evaluates the chief audit executive, receives the results of engagements and meets the CAE privately without management present. Administratively, the CAE reports to a senior executive, commonly the chief executive or chief financial officer, for the day-to-day matters a board cannot handle: pay, premises, HR processes, access to people and systems. The functional line is what makes the function independent; the administrative line is what makes it work inside the organization. The independence and objectivity guide explains the threats to this arrangement and the safeguards, and the chief audit executive guide describes the role itself.
| Stakeholder | What they get from internal audit | What internal audit needs from them |
|---|---|---|
| Board / audit committee | Independent assurance on risk, control and governance; an annual opinion in many functions; escalation of unresolved risks | Approval of the mandate, charter and plan; private access; backing when management resists |
| Chief executive and executive team | Early warning of control failures; advice on new initiatives; a view across silos | Access to information and people; timely responses to findings; resources |
| Process and control owners (the auditees) | A tested view of their own controls; recommendations; credit for well-run areas | Evidence, time and candor during fieldwork; action on agreed findings |
| Second-line functions (risk, compliance, security) | Assurance that their frameworks work; coordination so the business is not audited twice | Coordination of plans; sharing of monitoring results |
| External auditors and regulators | Work they may rely on after evaluating it; a window into the control environment | Access to reports and workpapers; a function they can trust |
The three kinds of work
The Standards recognize two services, and most functions carry a third stream alongside them. Assurance engagements are the core: the function examines evidence and reaches an independent conclusion on an area (a process, a program, a system, a risk) for the board and management, usually with a rating and findings. Advisory engagements are performed at management’s request to provide advice, facilitation, training or assessment without an assurance conclusion, with the scope agreed with the client and with safeguards so that the function does not later audit what it designed; the assurance vs advisory guide covers the rules. Investigations of specific allegations are performed by many functions under a protocol agreed with counsel, with different rules of evidence and reporting; the when internal audit finds fraud guide describes the moment an audit becomes one. The types of internal audits guide classifies fifteen engagement types within these streams; a typical plan is 70 to 85 percent assurance, 10 to 20 percent advisory and a reserve for investigations.
The process in seven stages
Whatever the type, an engagement follows the same arc from the annual plan to the confirmation that fixes happened. The table gives each stage, its output, the Standard that governs it and the guide on this site that goes deep. The step-by-step guide walks the whole process for beginners.
| Stage | What happens | Output | Standard | Deep dive |
|---|---|---|---|---|
| 1. Annual planning | The function maps the audit universe, assesses risk across it and builds a plan the committee approves | The risk-based audit plan | 9.4 | Building the plan; the audit universe |
| 2. Engagement planning | Understand the area, assess its risks, set objectives and scope, agree criteria, build the work program | Planning memo and work program | 13.1 to 13.6 | Engagement risk assessment; planning memo |
| 3. Fieldwork | Walkthroughs, control testing, analytics, interviews, observation; evidence gathered and documented | Workpapers; test results | 14.1 | Fieldwork guide; workpapers |
| 4. Evaluation | Compare condition with criteria, identify cause and effect, rate significance, develop findings | Finding sheets with the five Cs | 14.2 to 14.4 | The 5 Cs; severity ratings |
| 5. Reporting | Discuss findings with management, agree actions, write and issue the report, present to the committee | The audit report; committee summary | 11.2, 15.1 | Writing the report; the closing meeting |
| 6. Follow-up and validation | Track agreed actions, test the remediated controls, close issues on evidence | Validation memos; issue log | 15.2 | Issue validation |
| 7. Quality and learning | Supervisory review, self-assessment, performance measures, periodic external assessment | QAIP results to the board | 8.3, 8.4, 12.1 to 12.3 | QAIP playbook; preparing for an EQA |
A worked example: one engagement, start to finish
MidState Beverage, the three-state drinks distributor used in examples across this site, has twelve depots, about 300 delivery routes, roughly $221 million of revenue and a six-person internal audit function reporting to the audit committee. Its FY27 plan, built from a universe of 61 auditable entities, put route cash first: about $31 million a year is collected by drivers from some 4,200 cash-and-check customers, and the risk assessment rated it the highest inherent risk in the company. Here is how the seven stages played out.
Planning. The planning memo set the objective (are collections complete, deposited intact and reconciled independently at every depot?), the scope (all twelve depots, the route-accounting module and the deposit process, FY26 and the first quarter of FY27), the criteria (the cash handling policy, the segregation-of-duties standard and the reconciliation procedure) and a 520-hour budget. The engagement risk assessment identified the specific risks: reconciliations performed by the people who handle cash, system overrides approved by the same person who keyed them, synchronization failures between handheld devices and the module, and customers who never receive a statement and so could never notice a diverted payment.
Fieldwork. The team walked the process at three depots, then tested a stratified sample of sixty reconciliations, five per depot, across all twelve; fourteen failed. It extracted the override log from the module and found 1,412 of 37,400 overrides approved by the person who raised them. It selected seventy customer balances by monetary unit sampling and confirmed them, with twenty more chosen judgmentally. Evaluation produced five findings, two rated high (reconciliations not independent at nine of twelve depots; self-approved overrides) and three medium. Reporting rated the area Unsatisfactory, agreed eleven management actions, and recorded that the chief operating officer accepted the residual risk on one of them (statements for 1,130 customers), which was escalated to the committee under Standard 11.5. Follow-up is now a line in the FY28 plan: the validation of each action on evidence, not assertion. The full report is dissected in the report anatomy guide and the sampling in the monetary unit sampling guide; the engagement took 548 hours against 520 budgeted.
Forty key terms, defined
These are the terms a new auditor or auditee meets in the first month. Each is defined in a sentence; the glossary covers 120 with examples.
| Term | Meaning |
|---|---|
| Audit universe | The complete inventory of auditable entities (processes, units, systems, programs, risks) from which the plan is built |
| Risk-based audit plan | The schedule of engagements for a period, chosen by assessed risk and approved by the board |
| Audit charter | The board-approved document establishing the function’s purpose, authority, responsibility and reporting lines |
| Chief audit executive (CAE) | The head of internal audit, accountable to the board for the function |
| Audit committee | The board committee that oversees financial reporting, external audit and internal audit |
| Independence | Freedom from conditions that threaten the function’s ability to carry out its work without bias; an attribute of the function’s position |
| Objectivity | An unbiased mental attitude in the individual auditor; evidence over relationships |
| Engagement | One audit, review or advisory project with defined objectives and scope |
| Scope | The boundaries of an engagement: which processes, locations, systems and periods are included |
| Criteria | The standards against which the subject is evaluated: policies, laws, frameworks, good practice |
| Work program | The documented list of procedures to be performed to meet the engagement objectives |
| Walkthrough | Tracing a transaction through a process end to end to confirm understanding of how controls operate |
| Control | An action, device or process that reduces a risk to an acceptable level: an approval, a reconciliation, a system restriction |
| Preventive / detective control | A control that stops an error or fraud before it happens / one that finds it afterwards |
| Key control | A control whose failure would leave a significant risk unmitigated; the ones tested for SOX and in most process audits |
| Test of design | Evaluating whether a control, if operated as described, would address the risk |
| Test of operating effectiveness | Evaluating whether the control operated as designed over a period, usually by sampling |
| Sample / population | The items selected for testing / the full set they are drawn from |
| Exception / deviation | A sampled item where the control did not operate as designed |
| Evidence | Information the auditor relies on to reach a conclusion; it must be sufficient, reliable and relevant |
| Workpaper | The documentation of the work performed and evidence obtained, enough for a reviewer to reperform it |
| Tick mark | A symbol on a workpaper recording a specific procedure performed on an item |
| Finding (observation) | A documented gap between condition and criteria, with cause, effect and recommendation (the five Cs) |
| Condition / criteria / cause / consequence / corrective action | The five Cs that structure a complete finding |
| Root cause | The underlying reason a control failed, as opposed to the symptom observed |
| Rating | The severity assigned to a finding (high, medium, low) or the overall conclusion on an area (satisfactory to unsatisfactory) |
| Management action plan | Management’s committed response to a finding, with an owner and a date |
| Risk acceptance | Management’s documented decision not to remediate a finding, escalated to the board when the risk is significant |
| Issue validation | Testing that a management action has been implemented and is effective before an issue is closed |
| Inherent / residual risk | Risk before any controls / risk remaining after controls |
| Risk appetite | The amount and type of risk the organization is willing to accept in pursuit of its objectives |
| Materiality | The size of a misstatement or failure that would change a reader’s decision; defines what matters |
| Segregation of duties | Dividing a transaction’s steps among people so no one can both commit and conceal an error or fraud |
| Three Lines Model | The IIA’s model of roles: management (first), oversight functions (second), internal audit (third), under the governing body |
| Assurance / advisory | The two services the Standards define: an independent conclusion / advice without one |
| Co-sourcing / outsourcing | Using an external firm for part of the function’s work / for all of it |
| QAIP | Quality assurance and improvement program: the function’s own quality system, with an external assessment at least every five years |
| Global Internal Audit Standards (GIAS) | The IIA’s mandatory professional standards, effective January 2025, in five domains and fifteen principles |
| Topical Requirements | Mandatory IIA requirements for auditing specific topics (cybersecurity, third parties, organizational behavior, resilience) |
| Certified Internal Auditor (CIA) | The IIA’s global certification for internal auditors |
How internal audit creates value, and how to measure it
The question “what does internal audit actually contribute?” deserves specifics rather than slogans, because a function that cannot answer it will be cut in the next downturn. The table lists eight ways value is created, with the measure a committee can track for each. The KPI guide builds a full scorecard; the inside the department guide shows one function’s annual numbers.
| Source of value | How it shows up | Measure |
|---|---|---|
| Losses prevented | Control weaknesses fixed before they are exploited; fraud deterred by the knowledge that someone tests | Findings remediated; analytics exceptions resolved; losses recovered |
| Money recovered | Duplicate payments, overbilling, unclaimed discounts and payroll errors found by analytics and audits | Dollars recovered or avoided per year (MidState’s first AP analytics run recovered $279,000) |
| Regulatory exposure reduced | Compliance gaps found internally rather than by a regulator; validated remediation of regulatory findings | Self-identified vs regulator-identified issues; findings closed on time |
| Better decisions | Boards acting on an independent view rather than management’s own account | Committee-requested engagements; risks escalated and acted on |
| Process improvement | Efficiency recommendations adopted; duplicated work removed | Recommendations implemented; cycle times and costs after implementation |
| Reliance by others | External auditors and regulators relying on internal audit’s work, reducing external fees and examination burden | External audit hours reduced; examiner reliance recorded |
| Culture and deterrence | Managers maintain controls because they expect to be audited; ethics issues surface earlier | Hotline volumes; control self-assessment results; survey results |
| Talent | Auditors who understand the whole organization move into management roles | Alumni in leadership; rotation program outcomes |
The standards and bodies behind the profession
Internal audit is a profession with a global body, mandatory standards, a certification and a growing layer of topic-specific requirements. The Institute of Internal Auditors, founded in 1941, publishes the Global Internal Audit Standards (five domains, fifteen principles, fifty-two standards), the Topical Requirements and the Certified Internal Auditor credential. Beyond the IIA, auditors draw on COSO’s internal control framework (the five components and seventeen principles) and its enterprise risk management framework, on ISO 31000 for risk management, on COBIT and NIST for technology, and on sector regulation. Public-sector auditors in the United States follow the Government Accountability Office’s Yellow Book (GAGAS); the Yellow Book vs IIA Standards guide maps the two.
| Element | What it is | Status |
|---|---|---|
| Global Internal Audit Standards | The IIA’s professional standards: ethics, governance, managing the function, performing engagements | Mandatory for IIA members and functions claiming conformance; effective 9 January 2025 |
| Topical Requirements | Mandatory requirements for assurance engagements on specific topics | Cybersecurity (effective February 2026), Third-Party (September 2026), Organizational Behavior (December 2026), Organizational Resilience (April 2027) |
| Code of Ethics | Integrity, objectivity, competency, due professional care, confidentiality | Now Domain II of the Standards |
| Certified Internal Auditor | Three-part global certification | The profession’s primary credential; the CIA exam hub covers it |
| COSO frameworks | Internal Control (2013) and Enterprise Risk Management (2017) | The criteria most control and ERM audits use |
| External quality assessment | Independent assessment of conformance with the Standards | Required at least every five years (Standard 8.4) |
Misconceptions that cause friction
Six beliefs about internal audit are common, wrong and expensive, because each shapes how people behave when the auditors arrive. “Internal audit is here to catch people.” It is there to test controls; individuals appear in findings only when conduct is the issue, and that path runs through an investigation protocol, not an audit. “Internal audit works for the CFO.” It works for the board through the audit committee; the administrative line to an executive is for logistics. “Internal audit is the same as compliance.” Compliance runs the program; audit tests it. “A clean audit means nothing is wrong.” An audit samples; it gives reasonable assurance about what was tested, never a guarantee about everything. “Auditors should fix the controls they find broken.” Designing the fix would compromise the function’s ability to audit it later; management owns remediation. “Internal audit only matters in big companies.” The one-person audit shop and small company guides show how a function of one to three people delivers the objectives above at proportionate scale. The guide for auditees addresses the practical side for people being audited.
Questions people ask about internal audit
What is internal audit in simple terms?
An in-house function that independently checks whether the organization’s risks are managed and its controls work, reports what it finds to the board and management, and recommends improvements. It is the organization checking itself, by people who report to the board rather than to the managers being checked.
What are the main objectives of internal audit?
Providing assurance on risk management, controls and governance; assessing the safeguarding of assets and fraud exposure; verifying compliance with laws and policies; identifying operational improvements; and giving the board and management advice, insight and foresight.
What is the difference between internal and external audit?
External auditors are an outside firm appointed to give shareholders an opinion on the financial statements once a year. Internal auditors are part of the organization, report to the audit committee, and cover every significant risk and operation throughout the year.
Who does internal audit report to?
Functionally to the board, usually through the audit committee, which approves the charter and plan, hires the chief audit executive and receives the results; administratively to a senior executive for day-to-day matters.
What does an internal audit process look like?
Annual planning from a risk assessment of the audit universe, then for each engagement: planning (objectives, scope, criteria, work program), fieldwork (walkthroughs, testing, analytics), evaluation (findings with cause and effect), reporting (agreed actions, the report, the committee), follow-up (validating fixes) and the function’s own quality process.
Is internal audit mandatory?
It depends on the jurisdiction and sector. US-listed companies on the NYSE must have an internal audit function; banks and insurers in most countries are required to by their regulators; many governments require it in public bodies; for other private companies it is a governance choice that lenders, boards and acquirers increasingly expect.
What standards do internal auditors follow?
The IIA’s Global Internal Audit Standards, effective January 2025, plus the Topical Requirements for specific subjects; US government auditors also follow the GAO’s Yellow Book. Criteria for individual audits draw on COSO, ISO, COBIT, NIST and sector regulation.
Related guides
- The internal audit process step by step — the seven stages, one at a time.
- Internal audit jargon explained — 120 terms with examples.
- Types of internal audits — fifteen kinds compared.
- The Three Lines Model explained — where internal audit sits.
- Internal audit vs SOX vs compliance vs ERM — the four functions separated.
- Internal audit vs external audit — the two audits compared.
- The Global Internal Audit Standards — every domain, principle and standard mapped.
- GIAS Domain I — the purpose statement explained.
- What is a chief audit executive? — the head of the function.
- The internal audit charter — the document that establishes the function.
- How to build the internal audit plan — MidState’s FY27 plan in full.
- Audit fieldwork: the complete guide — the work inside an engagement.
- How to write an internal audit report — the product the board reads.
- Issue validation — confirming the fixes.
- Internal audit KPIs and metrics — measuring the function.
- Navigating an internal audit: a guide for auditees — the other side of the table.
- Assurance vs advisory services — the two services defined.
Leave a Reply