Internal audit and compliance are the two functions in a company most often confused with each other by everyone else, including, on bad days, by the people who run them. Both write policies-adjacent documents, both test whether rules are followed, both produce findings, both report to committees, and both are described by the business as “the people who tell us no.” The confusion has consequences. Boards that treat the compliance function’s monitoring as assurance have no independent view of whether the compliance program works. Audit functions that take on compliance monitoring stop being independent of it. Regulators, who understand the difference perfectly well, write findings about both errors. And people building careers in either field discover late that they chose a different profession than they thought.
This guide sets out the difference precisely and shows how the two functions work together when each does its own job. It contains the definitions from the standards each operates under, a fifteen-dimension side-by-side comparison, what each function does that the other cannot, how the Three Lines Model assigns their roles with a table showing who does what for a single regulation, the coordination mechanisms that stop them duplicating or contradicting each other, the criteria internal audit uses before relying on compliance testing, what happens in small companies where one person is both and in regulated ones where they must be separate, a worked comparison across two organizations, a career comparison, and the mistakes boards and practitioners make. It was rewritten in September 2026 to reflect the Global Internal Audit Standards and current regulatory expectations of compliance programs. The site’s guide to internal audit’s role in ERM covers the parallel boundary with the risk function.
In this guide
- Definitions: what each function is, by the standards it works under
- Side by side: fifteen dimensions
- What each does that the other cannot
- The Three Lines Model: who does what for one regulation
- Working together: coordination without contamination
- When internal audit can rely on compliance testing
- When the lines blur: small companies, regulated entities, and outsourcing
- Worked example: two organizations, two arrangements
- Careers: moving between the two
- Common mistakes
Definitions: what each function is, by the standards it works under
Internal audit is defined by its own global standards. The Global Internal Audit Standards describe internal auditing as independent, objective assurance and advisory services designed to add value and improve the organization’s operations, and the whole of Domain III is about the independence that makes the assurance worth having: functional reporting to the board, a chief audit executive appointed and removed by the board, and no operational responsibility for the areas audited. Internal audit’s product is an opinion, formed from evidence, about whether governance, risk management, and control processes, including the compliance program, are effective. It does not own any of them.
Compliance has no single global standard, and its definition comes from the regulators and frameworks that expect it. The Basel Committee’s 2005 paper on compliance and the compliance function in banks describes an independent function that identifies, assesses, advises on, monitors, and reports on the bank’s compliance risk; the US Department of Justice’s Evaluation of Corporate Compliance Programs, most recently updated in September 2024, sets out what prosecutors look for in a program (design, resourcing and empowerment, and whether it works in practice); sector rules such as the UK FCA’s SYSC requirements, US healthcare’s compliance program guidance, and the Federal Sentencing Guidelines’ seven elements describe the same function from different angles. Compliance is a second-line function: it belongs to management, it owns the compliance program, it writes and interprets policy, it trains, it advises the business on the law before decisions are made, it monitors adherence, it investigates, and it deals with regulators day to day. Its product is a program that keeps the organization inside the law and a management view of whether it is doing so. The Global Internal Audit Standards guide covers the first definition in full; the financial services guide the regulatory setting behind the second.
Side by side: fifteen dimensions
The table is the reference version of the difference. Read the reporting line, ownership, and independence rows first, because everything else follows from them: a function that owns the program cannot independently assure it, and a function that assures cannot own.
| Dimension | Internal audit | Compliance |
|---|---|---|
| Line in the Three Lines Model | Third line: independent assurance | Second line: management’s oversight and expertise function |
| Mandate | Assurance and advice on governance, risk management, and control across the whole organization | Management of compliance risk: keeping the organization within laws, regulations, and its own policies |
| Reporting line | Functionally to the board or audit committee; administratively to the CEO or another executive | To the CEO, general counsel, chief risk officer, or a board committee; in regulated firms often with a board reporting right, but as part of management |
| Independence | Organizational independence required by the Standards; no operational responsibilities in audited areas | Independence from the business lines it monitors, but not from management; it is management |
| Ownership | Owns nothing it audits; owns its own methodology and plan | Owns the compliance program: policies, training, monitoring, regulatory relationships |
| Governing standards | Global Internal Audit Standards (mandatory for IIA members’ functions); Topical Requirements | Regulatory expectations (DOJ ECCP, Basel, sector rules); frameworks such as the Federal Sentencing Guidelines’ seven elements; no single mandatory professional standard |
| Core activities | Risk-based planning; engagements with objectives, scope, evidence, and conclusions; reporting to the board; follow-up | Regulatory horizon scanning; policy drafting and interpretation; advice to the business; training; monitoring and testing; investigations; regulatory reporting and liaison |
| Testing versus monitoring | Periodic, sampled, evidence-based testing to reach a conclusion; a point-in-time opinion | Continuous or cyclical monitoring to detect and correct non-compliance; operational, not opinion-forming |
| Relationship to the business | Arm’s length; the business is the auditee | Partner and gatekeeper; involved before decisions are taken |
| Relationship to regulators | Regulators review the function’s work and rely on it; occasional direct interaction | Daily interaction; files reports; manages examinations; the regulator’s first point of contact |
| Scope | Everything: operations, finance, IT, strategy, culture, and the compliance function itself | Compliance risk: the laws and rules that apply, and the policies that implement them |
| Typical skills and certifications | Audit methodology, evidence, controls, analytics; CIA, CPA, CISA | Law and regulation, program management, investigation, training design; CCEP, CRCM, CAMS, legal qualifications |
| Deliverables | Audit reports with ratings and management actions; annual opinion on governance, risk, and control in some functions | Policies, training, monitoring reports, regulatory filings, breach reports, advice memos |
| Measures of success | Plan completion; findings acted on; committee confidence; conformance with the Standards | No regulatory breaches or fines; breaches detected internally; training completion; examination outcomes |
| Characteristic failure | Losing independence by taking on management work; auditing documents instead of practice | Becoming the business’s obstacle rather than its adviser; monitoring that reports what management wants; a program that exists on paper |
What each does that the other cannot
Internal audit can do one thing compliance cannot: tell the board, independently, whether the compliance program works. Compliance’s own monitoring reports are management’s view of management’s program, and however honest they are, they are not assurance in the sense the board and the regulator need, because the person reporting is the person accountable. Only the third line, reporting to the board and owning nothing in the program, can assess the design of the compliance framework, test whether the monitoring is real and the training changes behavior, and say so in a report management cannot edit. That is why bank regulators require independent testing of anti-money-laundering programs as a pillar separate from the compliance officer, why the DOJ asks whether the compliance program is “periodically tested” by someone independent, and why an audit committee that receives compliance’s dashboard and nothing else has an untested program.
Compliance does three things internal audit cannot without impairing itself. It advises the business before a decision: whether a marketing campaign complies with consumer rules, whether a payment to an agent is permissible, whether a product needs a license. Internal audit that gives that advice and later audits the decision has reviewed its own work. It owns and operates the program: writes the policy, runs the hotline, delivers the training, files the regulatory report, manages the examination. Internal audit that operates any of those has taken management responsibility, which the Standards prohibit. And it monitors continuously, inside the business’s own rhythm, catching and correcting breaches as they happen; internal audit’s periodic sampling is designed for opinions, not for operational detection. The division is not a turf arrangement; it is what makes each function’s output mean what it claims. The GIAS Domain III guide covers the independence rules that draw the line, and the Domain II guide the objectivity impairments that follow from crossing it.
The Three Lines Model: where compliance sits, where audit sits, and why the 2020 update matters
Most of the confusion between the two functions traces back to the old “three lines of defense” diagram, which drew compliance and internal audit as two boxes stacked behind the business as if they were successive layers of the same wall. The IIA’s 2020 revision, now simply the Three Lines Model, dropped the word “defense” and reframed the lines as roles rather than boxes. The first line is management delivering products and services and managing the risks that come with doing so. The second line provides expertise, support, monitoring, and challenge on risk-related matters; compliance, risk management, information security, and the privacy office all sit here, and the model is explicit that second-line roles are part of management. The third line is internal audit alone, providing independent and objective assurance and advice, reporting to the governing body, and free of management responsibility for anything it might audit. The governing body sits above all three, accountable for oversight and for the existence and independence of internal audit.
Two consequences follow. The first is that compliance can never be a third-line function no matter how independent its charter sounds, because it owns the design of the compliance program, which is a management responsibility. The second is that internal audit can never be a second-line function no matter how deep its regulatory expertise, because the moment it designs or operates the program it has become part of the thing it is supposed to assure. The guide to internal controls and the Three Lines Model works through the whole model; the table below shows how it plays out for a single obligation, in this case a new state consumer-privacy statute that a mid-sized company has eighteen months to comply with.
| Activity | Governing body | First line (operations, IT, marketing) | Second line (compliance and privacy) | Third line (internal audit) |
|---|---|---|---|---|
| Deciding the law applies and what it requires | Sets risk appetite; approves the program budget | Confirms which products and data flows are in scope | Interprets the statute, drafts the policy, defines the required controls, sets the deadline plan | No role in interpretation; may advise on whether the plan is realistic |
| Building the controls | None | Redesigns consent capture, data-subject request handling, retention deletion jobs, vendor contracts | Advises on design, reviews for adequacy, signs off on the control inventory | None; may review the project at a milestone as an advisory engagement |
| Training | Receives a briefing | Attends; managers confirm completion | Designs and delivers, tracks completion rates | Later tests whether completion records are accurate |
| Day-to-day operation | None | Operates the controls: answers requests within the statutory window, runs deletion jobs, keeps records | Provides a helpline, resolves gray-area questions, logs incidents | None |
| Monitoring adherence | Reviews quarterly metrics | Supervisors check their own teams | Runs a monitoring program: samples requests monthly, reviews the incident log, tests vendor attestations, reports metrics to management | Does not monitor; relies on or re-performs the monitoring later |
| Independent assurance | Receives the audit report and management’s response | Provides evidence, responds to findings | Provides evidence, responds to findings, is itself in scope | Audits the program: design against the statute, operation across a sample, and the reliability of compliance’s monitoring |
| Reporting to the board | Reads both reports and asks why they differ if they do | Through management reporting | Program status, metrics, incidents, regulator contact, through the management line | Independent opinion on whether the program works, through the audit committee |
| Regulator inquiry | Informed; approves the response strategy with counsel | Supplies records | Owns the response with legal counsel; is the point of contact | Reviews the accuracy of what was sent if asked, or as part of a later audit; never speaks for management |
| Remediation of failures | Tracks closure of significant items | Fixes the control and evidences the fix | Confirms the fix meets the policy; updates the control inventory | Validates the fix independently before closing its own finding |
Read down the compliance column and every entry is an act of management: interpret, design, deliver, operate, monitor, report, respond. Read down the audit column and almost every entry is an act of assessment performed after the fact and reported outside the management line. The two columns rarely contain the same verb, and when they appear to, the difference is who the work is for. Compliance’s monitoring tells management whether the program is running; audit’s testing tells the board whether management’s account of it can be trusted.
How the two functions work together without collapsing into each other
Separation is not the same as distance. The functions that work well together share information constantly and keep their conclusions apart. The mechanisms below are the ones I have seen hold up across banks, manufacturers, and healthcare systems; each one has an owner, a cadence, and a rule about what is not shared.
| Mechanism | Who owns it | Cadence | What is shared | What stays separate |
|---|---|---|---|---|
| Combined assurance map | Internal audit compiles; compliance and risk contribute | Annual, refreshed at the half year | Which obligations and risks are covered by which line, with dates and depth of coverage | Audit’s risk ratings and its plan remain its own; the map informs the plan, it does not set it |
| Regulatory-change feed | Compliance | Monthly bulletin plus ad hoc alerts | New rules, effective dates, the affected processes, compliance’s assessment of impact | Audit decides for itself whether a change warrants an engagement |
| Monitoring results | Compliance | Quarterly pack to audit | Testing results, exception trends, incident log, regulator correspondence log | Audit may re-perform, extend, or disregard the results; it does not co-sign them |
| Audit plan consultation | Internal audit | Annual, before audit committee approval | Draft plan, timing, expected requests for evidence | Compliance may object to timing; it cannot remove an engagement |
| Issue register alignment | Joint, one system where possible | Continuous | Open issues, owners, due dates, closure evidence, so management sees one list | Each function closes its own issues on its own evidence; a compliance closure does not close an audit finding |
| Joint reporting to the audit committee | Committee chair sets the agenda | Quarterly | Compliance reports program status; audit reports assurance results; both attend both items | Separate papers, separate private sessions; the committee is meant to hear two voices |
| Secondments and rotations | Both heads | As roles allow | Staff move between the functions and bring knowledge with them | A returning auditor is kept off assurance over compliance work they performed for at least a year, per the objectivity rules in GIAS Domain II |
| Escalation protocol | Both heads, agreed with the general counsel | Standing | Who is told what, and when, if either function finds evidence of a breach or of misconduct | Audit’s duty to report to the audit committee is not overridden by a compliance or legal instruction to hold |
The combined assurance map deserves a word, because it is the single document that stops the two functions from either duplicating each other or both assuming the other has something covered. Built properly, it lists every material obligation and risk down the side, the lines across the top, and in each cell what coverage exists, how deep it goes, and when it last happened. The gaps it exposes are usually more useful than the overlaps: the regulation that compliance monitors only by attestation and audit has never tested, or the operational risk that appears in the ERM register but in nobody’s plan. The internal audit risk assessment guide shows how the map feeds the plan, and the GRC framework guide covers the tooling that keeps it current.
When internal audit can rely on compliance’s work, and how much
A compliance function that tests two hundred loan files a quarter produces evidence that internal audit would be foolish to ignore and reckless to adopt unexamined. GIAS Standard 9.5 on coordination and reliance frames the choice: the chief audit executive must coordinate with the other providers of assurance and may rely on their work, but only after assessing the basis for that reliance, and the responsibility for the conclusions internal audit reports stays with internal audit no matter whose testing sits underneath them. In practice the assessment comes down to the criteria in the table below, and the honest answer for most compliance functions is partial reliance: their work reduces the amount of testing audit performs, it does not replace it.
| Criterion | What to look for | Evidence to obtain | If it fails |
|---|---|---|---|
| Objectivity of the testers | Compliance testing staff do not test controls they designed or operate; a testing team separate from advisory staff; reporting line to the chief compliance officer, not to the business tested | Organization chart, testing charter, a walk through who tested what last quarter | Treat the results as management’s self-assessment: useful for scoping, no reduction in audit’s own testing |
| Competence | Testers hold relevant credentials (CRCM, CAMS, CCEP, CIPP) or documented training; supervisors review the work | Training records, review sign-offs, a sample of workpapers | Re-perform a larger share; recommend the gap as a finding on the program |
| Methodology | Written test plans with defined populations, sampling basis, exception definitions, and tolerance thresholds; populations reconciled to source systems | The test plan, the population extract with its completeness check, the sampling log | Cannot rely on results whose population you cannot trust; test from your own extract |
| Evidence quality | Workpapers retained, conclusions traceable to documents, work re-performable by someone who was not there | Re-perform a sample of their sample; typically 10 to 25 percent of items, more where the risk is high | Reliance on that test cycle is withdrawn; escalate if the exceptions were understated |
| Reporting and escalation | Results reported to management with exceptions tracked to closure; no evidence that findings were softened or removed after review | Compare draft and final reports; trace exceptions to the issue log | A softening pattern is itself a finding about the program’s governance, and reliance ends |
| Coverage and timing | The period and population tested overlap the period audit is opining on; frequency matches the risk | Testing calendar, sample dates | Reliance is limited to the overlapping period; audit fills the rest |
| Track record | Prior re-performance found compliance’s results within tolerance; corrective actions from prior audits of the program were completed | Audit’s own history of re-performance results | First-year reliance is always thinner; earn it over cycles |
The mechanics of partial reliance are simple. Audit re-performs a slice of compliance’s tests, documents that the re-performance agreed with their results, and then reduces its own direct sample rather than eliminating it. A program that would ordinarily warrant a sample of 60 items from audit might, with a satisfactory re-performance of compliance’s 200, be tested with 25 of audit’s own items plus the re-performed slice, and the workpaper states exactly that arithmetic and the reasons for it. The sample size guide covers the underlying logic and the audit evidence guide the standard the re-performed items must meet. What audit must never do is cite compliance’s testing as its own, or describe the program as tested when what it did was read compliance’s summary of the testing.
Bank examiners have their own version of this test. The FFIEC BSA/AML Examination Manual treats independent testing as one of the pillars of the program and expects the people who perform it to be independent of the BSA/AML compliance function; internal audit, an outside firm, or another qualified independent party can do it, compliance’s own monitoring staff cannot. The same logic runs through the Federal Reserve’s expectations for the internal audit function in SR 13-1 and the OCC’s Heightened Standards for the largest banks: compliance monitoring is a second-line control, and the regulator wants to see a third line that tested it. The AML audit guide covers how that independent test is scoped and where it usually finds problems.
Where the lines blur, and the safeguards that keep them honest
Organization charts rarely match the model. Small companies combine the functions in one person, mid-sized ones ask internal audit to do management’s SOX testing because it has the people, and banks sometimes route compliance through the chief audit executive because someone once said both were “independent”. None of these arrangements is automatically fatal; each one impairs something, and the question is whether the impairment is disclosed and contained or hidden and compounding. GIAS is specific on the point that matters most: internal auditors must not provide assurance over an activity they had responsibility for within the previous year, and where independence or objectivity is impaired in fact or appearance, the impairment must be disclosed to the appropriate parties. The Domain II guide lists the impairments; the table below lists the situations that produce them.
| Situation | Why it blurs the lines | Minimum safeguard | When to decline |
|---|---|---|---|
| One person is both head of compliance and head of internal audit | The same person designs the program and assures it; the audit committee hears one voice | Disclose the arrangement in the audit charter and to the committee; buy an external quality assessment or co-sourced assurance over the compliance program itself; keep separate reports | When the company is regulated and the regulator expects independent testing, the combination will not survive an exam and should be split |
| Internal audit performs management’s SOX 404 control testing | Testing on management’s behalf is a first- or second-line activity; audit cannot then independently assure the same controls | Put the work in a separately staffed team, label it as management’s testing in every workpaper, disclose the arrangement to the audit committee, and exclude those staff from assurance over the same controls for a year | When the same people would be asked to both perform management’s testing and issue audit’s opinion on ICFR support; see the SOX 404 guide |
| Compliance reports to the chief audit executive | The CAE has management responsibility for a function audit must assure | Compliance’s assurance must come from outside: co-source or external firm reporting to the audit committee; the CAE recuses from those engagements | Treat as a transitional arrangement with a dated plan to move compliance under the general counsel or a chief risk officer |
| Internal audit administers the organization-wide issue tracking system | Audit begins to act as the owner of remediation rather than its validator | Audit may host the tool; management owns the entries, the due dates, and the decision to close; audit validates independently | When audit staff are asked to negotiate due dates or close issues on management’s behalf |
| Internal audit helps build the compliance program as an advisory engagement | Legitimate under GIAS, but the advice becomes a management decision audit later has to assess | Written advisory terms of reference; recommendations, not decisions; no operational role; one-year cooling period before assuring the same program; disclosure in the audit plan | When management wants audit to sign off on the design as adequate, which converts advice into assurance without the independence |
| Compliance monitoring is labeled “independent testing” to satisfy a regulator | Second-line work presented as third-line assurance | Rename it; give audit or an outside party the independent test; let compliance’s monitoring stand on its own as monitoring | Always; the mislabel is the problem |
| Auditors rotate into compliance and back | Objectivity impaired for work they performed while seconded | Exclude from assurance over their own former work for a year; document the exclusion in the staffing memo | When the function is so small the exclusion leaves nobody to do the work; co-source that engagement |
The pattern across every row is the same three moves: name the impairment, contain it with a structural safeguard, and disclose it to the governing body so that the people relying on the assurance know what they are getting. The arrangements that go wrong are not the ones where a small company had to combine roles; they are the ones where the audit committee believed it was receiving independent assurance over compliance and was actually receiving compliance’s assessment of itself, relabelled. The audit charter guide covers how to write the disclosure into the charter, and the small-company guide covers what to do when there is nobody to split the roles between.
Two worked examples: a company with no compliance function, and a bank with a large one
MidState Beverage, the three-state distributor that runs through many of the guides on this site, has twelve depots, three hundred delivery routes, a six-person internal audit function, and no compliance department at all. Nobody decided that; the company simply grew from a size where the owner knew every rule to a size where nobody did. The gap surfaced when roadside inspections at two depots produced out-of-service orders for hours-of-service violations, and the follow-up showed that each depot manager had assumed the fleet coordinator owned driver-log compliance while the fleet coordinator assumed the depots did. The chief executive’s first instinct was to ask the chief audit executive to “own DOT compliance”, which is the request every audit leader in a company this size eventually hears.
The answer was no, followed by an offer. Owning compliance would have put internal audit in the second line, made it responsible for a program it would later have to assure, and left the audit committee with nobody independent to tell it whether the program worked. What audit could do, and did as engagement eight of the FY27 plan with three hundred advisory hours, was help management see the whole obligation set and assign it. The engagement produced a compliance inventory, an owner for every line, a definition of what monitoring each owner would perform, and a recommendation that the company create a compliance coordinator role inside operations, reporting to the chief operating officer rather than to audit. The inventory, in abbreviated form, looked like this.
| Obligation | Owner assigned | Control the owner builds | Owner’s monitoring | Internal audit’s role |
|---|---|---|---|---|
| FMCSA hours-of-service and electronic logging | Fleet coordinator, with depot managers | ELD exception reports reviewed weekly; unassigned driving time resolved within seven days | Monthly violation rate by depot to the COO | Assurance engagement in FY28, after the one-year advisory cooling period |
| Driver qualification files and medical certificates | Human resources | File checklist; expiry tracker with sixty-day alerts | Quarterly file completeness check, 100 percent | Sample files in the FY28 fleet engagement |
| State licensing and excise obligations on products carried | Controller | License calendar; excise returns reconciled to depot volumes | Monthly reconciliation reviewed by the CFO | Covered within the FY27 financial close engagement |
| Sales tax in three states, including the two acquired distributors | Controller, with the acquisition integration lead | Tax engine configuration; exemption certificate files | Quarterly exemption certificate sample | Covered within the FY27 acquisition integration engagement |
| OSHA forklift certification and warehouse safety | Warehouse director | Certification register; incident log with root-cause field | Monthly register review; incident trend to the COO | Sampled within the FY27 warehouse inventory engagement |
| Wage-and-hour rules for drivers and warehouse staff | Human resources with payroll | Overtime and meal-break rules configured in time capture; exception review | Monthly exception report | Candidate for FY28; payroll analytics meanwhile |
| Route cash and customer statement rules under the credit policy | Depot managers, with the controller | Already addressed by the FY27-01 route cash findings | Depot reconciliation dashboards | Validation of each action as it comes due, alongside the FY26 findings in engagement seven |
| Compliance coordination overall | New compliance coordinator, reporting to the COO | Maintains the inventory, tracks regulatory change, chairs a quarterly review | Quarterly inventory status to the executive team and the audit committee | Audits the coordinator’s program itself once it has run for a year |
Three things about the engagement are worth noticing. Audit wrote none of the policies; it drafted the inventory and the owners wrote their own. Audit performed no monitoring; the monthly and quarterly checks in the fourth column belong to the owners, and the coordinator reports on whether they happened. And audit scheduled its own first assurance over fleet compliance for the following year, because the people who helped build a program cannot assure it the same year under GIAS, and the audit plan said so in plain words when the audit committee approved it. The audit plan guide shows the full FY27 plan this engagement sits in.
Lakeshore Bancorp is the opposite case: a nine-billion-dollar public bank holding company with twenty-two in-house auditors and a compliance function of about forty people under a chief compliance officer, including a six-person compliance testing team that runs quarterly monitoring over the BSA/AML program: alert dispositions, currency transaction report timeliness, suspicious activity report decision documentation, and customer identification at account opening. Internal audit performs the annual independent test the FFIEC manual expects, budgeted at seven hundred hours across BSA/AML and sanctions screening. Reliance is negotiated every year on evidence rather than assumed. In the most recent cycle audit re-performed 40 of the 240 items compliance testing had examined, about 17 percent, found no disagreements, documented the assessment of compliance testing’s objectivity, competence, and methodology against the criteria above, and reduced its own direct samples from 60 to 25 items in the areas where the re-performance held. The workpaper shows the arithmetic and the reasons.
The instructive moment came from an examination finding. The bank’s primary regulator issued a matter requiring attention over an alert backlog of roughly 1,900 transaction-monitoring alerts aged more than thirty days. Compliance owned the remediation: it added contract analysts, cleared the backlog in eleven weeks, and reported the matter closed to the board. Internal audit, which had opened its own finding when the backlog appeared, did not close it on compliance’s word. It sampled 60 dispositions from the cleared batch and found 7, about 12 percent, with no documented rationale for closing the alert, which is the exact defect that turns a cleared backlog into a future examination finding. Audit’s finding stayed open, compliance re-reviewed the batch, and the audit committee heard both accounts in the same meeting. That is the relationship working as designed: compliance fixed the problem quickly, audit checked whether the fix was real, and the board got the difference between the two. The regulatory issue lifecycle guide covers how audit validates MRA remediation, and the issue validation guide the sampling behind it.
Careers: choosing between the two, and moving from one to the other
People ask which function is the better career as if the answer were general. It is not; it depends on whether you would rather build and run something or examine and judge it, and on how much you enjoy the regulator-facing side of corporate life. The two paths look alike from a distance, share a vocabulary, and recruit from each other constantly, which is why the differences in the table are the ones to weigh. Pay is broadly comparable at equivalent levels in most industries, with a premium for specialist compliance roles in banking and pharmaceuticals, and I am not going to quote figures that will be stale by the time you read them.
| Dimension | Internal audit | Compliance |
|---|---|---|
| Typical entry point | Accounting or finance degree, a public accounting firm, a rotational program, or a move from operations or IT | Law, a regulator, a business role in a regulated product, or a move from audit |
| Credentials that matter | CIA, CPA or CA, CISA, CFE; see the CIA exam guide | CRCM for banking compliance, CAMS for AML, CCEP for corporate ethics and compliance, CIPP for privacy, CHC for healthcare, plus a law degree in many senior roles |
| Career ladder | Staff auditor, senior, manager, senior manager or director, chief audit executive | Analyst, compliance officer, manager, director, chief compliance officer; deputy general counsel in some structures |
| Shape of the work | Project-based: a series of engagements with a beginning, fieldwork, and a report; wide exposure across the business | Program-based: standing responsibility for a set of obligations; deep exposure to a regulatory domain and its regulator |
| Skills that get rewarded | Evidence and testing discipline, process analysis, data analytics, writing findings people act on, professional skepticism | Regulatory interpretation, policy drafting, training and influence, investigations, managing regulator relationships |
| Who you report to | Functionally the audit committee; administratively the CEO or CFO | General counsel, chief risk officer, or CEO, with board reporting through a risk or compliance committee |
| Independence trade-off | Distance from decisions; you recommend, management decides | In the decisions; you own the outcome and the regulator’s attention when it goes wrong |
| Moving across | Audit to compliance is the common direction: auditors who found a domain they liked and want to run it | Compliance to audit is rarer and valued for domain depth; expect a year off assurance over your former program |
| Where people go next | Finance, risk, operations, consulting, or up to CAE | Risk, legal operations, the regulator itself, consulting, or up to CCO |
For someone early in a career the honest advice is that audit gives the wider view and compliance the deeper one, and the best senior people in either function have done a stint in the other. The By Role hub lays out the audit ladder from first job to chief audit executive, the interview guide covers what audit hiring managers actually ask, and the guide to the internal audit department describes the roles from the inside.
Common mistakes when the two functions share an organization
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Audit adopts compliance’s results as its own | The audit report says a program was “tested” when audit read compliance’s summary | The board believes it has independent assurance it does not have; the first examiner to re-perform will find out | Reliance assessment on file, re-performance of a slice, audit’s own residual sample, and a report that says which is which |
| Compliance monitoring labeled independent testing | The BSA officer’s team performs the “annual independent test” of its own program | Fails the FFIEC independence expectation outright; a standing examination finding | Independent test by audit or an outside party; monitoring keeps its own name |
| Two issue registers with two closure standards | Compliance closes on management’s assertion; audit closes on evidence; management sees contradictory status | Remediation credibility collapses; the board gets two answers to one question | One register, one taxonomy, each function closing its own items on its own evidence; see the issue log template |
| Audit plan built only from the regulatory calendar | Every engagement is a compliance topic; operational and strategic risks go untested | Audit becomes a shadow compliance function and stops giving the board what only it can give | Risk-based plan across the full universe, with compliance topics as one input; see the risk-based auditing guide |
| The committee hears one voice | Compliance and audit present a single combined paper, or only one of them attends | Disagreement between the functions is the most valuable signal the board can receive, and it is suppressed | Separate papers, both present for both items, separate private sessions |
| The compliance audit re-checks compliance’s checklist | Audit tests whether compliance ticked its boxes rather than whether the obligation is met | A perfectly completed checklist for a badly designed program passes the audit | Scope from the obligation outward: design against the rule, operation across a sample, then the quality of monitoring |
| “Just this once” operational help | Audit drafts the policy, runs the monthly log review, answers the regulator’s letter | Each instance creates a one-year assurance exclusion and, repeated, converts the function to second line | Advisory terms of reference or a polite no; the Domain III guide gives the words |
| Softened monitoring results | Exceptions disappear between compliance’s draft and final report after business review | Management is steering the second line’s findings; audit relying on the final report inherits the distortion | Audit compares drafts to finals as a standing step in its reliance assessment; a pattern becomes a governance finding |
| Advisory without a cooling period | Audit helps design the program in the spring and audits it in the autumn | Breaches the one-year rule in GIAS and the appearance of objectivity with it | Date the advisory in the plan; schedule the first assurance for the following year; disclose |
| Nobody owns the obligation set | Every manager assumes another function has a rule covered, as MidState did with driver logs | The gap is found by an inspector, a plaintiff, or a journalist rather than by the company | A compliance inventory with named owners, refreshed quarterly, and audit coverage of the inventory itself |
The distinction that runs through every row is the one the whole guide rests on. Compliance is management’s way of meeting its obligations. Internal audit is the board’s way of finding out whether management has. An organization needs both, needs them to talk constantly, and needs them never to become the same thing. The compliance risk guide covers the risk itself in depth, and the guide to what regulators expect explains how examiners judge whether the two lines are doing their jobs.
Related guides
- What are internal controls, who tests them, and how the Three Lines Model guides their assurance
- Compliance risk: a comprehensive guide
- Compliance vs. compliance risk
- Building a GRC framework
- Continuous regulatory readiness: MRAs and MRIAs
- The lifecycle of regulatory issues
- What regulators really expect
- AML audit guide
- Internal audit’s role in ERM
- Global Internal Audit Standards overview
- GIAS Domain III: governing the function
- The IIA Topical Requirements
- Inside the internal audit department
- How to write an internal audit charter
- Start here
- Internal Audit vs SOX vs Compliance vs ERM: Who Does What — the four functions separated by mandate, reporting line and output
- Compliance Risk Assessment: Method, Scoring, Worked Example — obligations inventory, exposure scoring and prioritization that regulators accept
- Auditing the Ethics and Compliance Program: Tests & Metrics — a program-effectiveness audit mapped to the DOJ and Sentencing Guidelines criteria.
Leave a Reply