No. Internal audit is not accounting, and the confusion costs students the wrong major, accountants a career they might have liked, and boards a function they misuse. Accounting records and reports what happened to an organisation’s money; internal audit evaluates whether the organisation is managed well enough for the risks it carries, of which the money is one. The two professions share a vocabulary, a corner of the universe (the financial processes) and a credential some people hold in both, and they differ in purpose, output, standards, reporting line, skills and career. This guide gives the short answer and the long one: the ten dimensions on which the professions differ; the four professions people run together; where internal audit uses accounting and how much of the job it is; the accounting concepts an internal auditor has to master, with what each one does for an audit; what the rest of the job is; the careers and the credentials; the misconceptions, in both directions; and a worked example of a company whose controller asked the same question.
It absorbs the former guide to the five accounting concepts every internal auditor must master as its sixth section. For the broader comparison of the audit professions, the internal audit versus external audit guide is the companion piece, and the degrees guide covers the choice that often prompts the question.
In this guide
- The short answer and the long one
- The four professions people confuse
- Where internal audit uses accounting
- The accounting concepts an internal auditor must master
- What the rest of the job is
- How the two work together during the year
- A week in each job
- Careers, credentials and pay
- Moving between the two
- Misconceptions in both directions
- Worked example: Brightwater Foods asks the question
- Frequently asked questions
- Related guides
The short answer and the long one
Accounting is the recording, classification, summarising and reporting of financial transactions and the preparation of financial statements under a reporting framework; its product is information. Internal audit is an independent, objective assurance and advisory activity, in the IIA’s definition, that evaluates governance, risk management and control across the whole organisation; its product is an opinion and the actions it causes. Accounting is one of the processes internal audit evaluates, and far from the largest. The table gives the ten dimensions on which the two differ.
| Dimension | Accounting | Internal audit |
|---|---|---|
| Purpose | Produce accurate, timely financial information and statements | Provide assurance that governance, risk management and control are effective, and advice to improve them |
| Product | Ledgers, reports, financial statements, reconciliations | Audit reports with ratings and findings; an annual opinion; advisory work |
| Scope | Financial transactions and reporting | Every process, system and risk in the organisation: operations, technology, compliance, strategy, culture, and finance |
| Standards | GAAP or IFRS for the output; the organisation’s policies for the process | The IIA’s Global Internal Audit Standards; the Code of Ethics; frameworks such as COSO as criteria |
| Reporting line | The controller, the chief financial officer, management | Functionally the audit committee of the board; administratively the chief executive or chief financial officer |
| Independence | Part of management; owns the numbers | Independent of management through the reporting line; must not own what it audits |
| Time orientation | Recording the period just ended; closing the books | Forward-looking: risks that have not crystallised; controls that would prevent them |
| Core skills | Technical accounting, systems, the close, analysis | Risk and control thinking, evidence and testing, interviewing, writing, judgment; the skills guide lists twelve |
| Credential | CPA, CA, CMA, ACCA | CIA; also CISA, CFE; CPA where the function values it |
| Career ladder | Staff accountant, senior, manager, controller, chief financial officer | Staff auditor, senior, manager, director, chief audit executive, with moves into risk, compliance and operations |
The four professions people confuse
The question usually hides a four-way confusion, because external audit and compliance sit between accounting and internal audit and borrow from both. The internal audit versus compliance guide and the Three Lines Model guide draw the organisational lines; the table draws the professional ones.
| Profession | What it does | Who it serves | Where it sits | Credential |
|---|---|---|---|---|
| Accounting | Records transactions and produces financial information and statements | Management, then investors and regulators through the statements | Inside the finance function; first line | CPA, CA, CMA |
| External audit | Expresses an independent opinion on whether the financial statements are fairly stated | Shareholders and the public, through the audit committee | Outside the organisation; a public accounting firm | CPA, CA |
| Compliance | Ensures the organisation meets its legal and regulatory obligations; monitors and tests | Management and the board; regulators | Inside the organisation; second line | Industry credentials (CRCM, CAMS and others) |
| Internal audit | Evaluates governance, risk management and control across the organisation and reports to the board | The audit committee and senior management | Inside the organisation; third line, independent of management | CIA |
Where internal audit uses accounting
Accounting is the subject matter of a defined slice of the audit universe and a tool everywhere else. The table lists the engagements where accounting knowledge is the main requirement and what each needs; in a typical corporate function they make up between a fifth and a third of the plan, and in a bank less, because the balance sheet risks (credit, liquidity, interest rate) are audited by risk specialists rather than accountants.
| Engagement | Accounting knowledge needed | What internal audit tests | Where to read more |
|---|---|---|---|
| Financial close and reporting | The close process, journal entries, consolidation, disclosure | Controls over the close: cut-off, journal entry approval, reconciliations, review | The types of internal audits guide |
| SOX 404 and internal control over financial reporting | COSO, financial statement assertions, key controls, deficiency evaluation | Design and operating effectiveness of key controls; deficiency severity | The SOX 404 guide |
| Revenue, procure-to-pay, payroll, fixed assets | Recognition rules, three-way match, accruals, capitalisation | Process controls from initiation to the ledger | The procurement audit guide and the process guides |
| Accounting estimates | Allowances, impairments, provisions, fair value, the models behind them | Governance of the estimate, assumptions, model controls, review | The model risk audit guide |
| Treasury and cash | Cash accounting, debt, investments, hedge accounting | Cash controls, bank reconciliations, covenant compliance, hedging | The treasury audit guide |
| Fraud and investigations | How schemes appear in the books: fictitious vendors, revenue manipulation, expense fraud | Red flags, analytics, investigation | The fraud risk management guide |
| Regulatory and tax reporting | The reports’ basis in the ledger; reconciliation | Data lineage from ledger to report; review controls | The financial services guide for bank reporting |
| Everything else | Enough to read a budget, a cost report or a business case and to translate a finding into money | Operational, technology and compliance controls | The rest of this site |
The accounting concepts an internal auditor must master
The list below is also the answer to a question accountants ask from the other side: how much accounting does the move into internal audit require them to keep? All of it, at the level of concept and risk, and little of it at the level of execution. The internal auditor who can explain why a change in the allowance methodology moved earnings is more useful than one who can book the entry.
An internal auditor does not need to be able to close the books, and does need a working command of the concepts that create financial reporting risk, because they are where financial misstatements and the frauds behind them live. The nine below are the ones that recur in findings, each with what it means, why it matters to an audit and the finding it typically produces.
| Concept | What it means | Why it matters to internal audit | Typical finding |
|---|---|---|---|
| Accrual basis and cut-off | Revenue and expenses are recognised when earned or incurred, not when cash moves; transactions belong to the period in which they occurred | Period-end manipulation and honest error both happen at the cut-off; the close is where most financial reporting controls sit | Accruals released or booked to meet a target; shipments recorded before the goods left |
| Revenue recognition | The five-step model (ASC 606 and IFRS 15): contract, performance obligations, price, allocation, recognition when control transfers | Revenue is the most manipulated line in financial reporting history; side agreements, bill-and-hold and channel stuffing all live here | Revenue recognised on contracts with unmet obligations; manual adjustments without support |
| Estimates and judgment | Allowances for credit losses (CECL, IFRS 9), impairments, warranty and legal provisions, fair values, useful lives | Estimates are where management’s judgment meets the statements; the controls are over assumptions, models and review | Assumptions changed without approval; no sensitivity analysis; model not validated |
| Asset valuation and impairment | Historical cost, fair value, lower of cost and net realisable value; impairment tests for goodwill and long-lived assets | Overstated assets hide losses; impairment triggers are often ignored | Goodwill not tested after a strategic change; inventory reserves unsupported |
| Provisions and contingent liabilities | Recognise when probable and estimable (ASC 450) or more likely than not (IAS 37); disclose when possible | Litigation, regulatory and restructuring exposures are understated more often than overstated | Legal reserve set without counsel’s assessment; regulatory matters undisclosed |
| Internal control over financial reporting | The COSO components applied to the statements: entity-level controls, process controls, IT general controls, key controls over assertions | The framework for every financial process audit and for SOX | Key controls that operate but do not address the assertion; management review controls without evidence of review |
| The close and consolidation | Sub-ledger to ledger, journal entries, intercompany eliminations, consolidation adjustments, the reporting package | Manual journals and consolidation are the classic fraud and error channels | Journal entries posted and approved by the same person; intercompany differences written off |
| Financial statement relationships | The links between statements: revenue to receivables and cash; inventory to cost of sales; capital expenditure to fixed assets and depreciation; ratios and trends | Analytical review detects what tests of detail miss, and it is how an auditor reads a business quickly | Receivables growing faster than revenue with no explanation; margins inconsistent with pricing |
| Leases, consolidation of entities and off-balance-sheet structures | Lease capitalisation (ASC 842, IFRS 16); control and consolidation of entities; special-purpose vehicles | Structures designed to move obligations off the statements have featured in most large frauds | Entities not consolidated; lease obligations understated |
The practical standard is this: an internal auditor should be able to read an annual report and the notes, say where the judgment is, identify which processes produce each material line, and translate any finding into its effect on the statements and on cash. The SQL for auditors guide and the analytics guides are how the relationships in the last row are tested across whole populations.
What the rest of the job is
A test that settles the question for any particular function: list the last twenty engagements and mark the ones a controller could have performed with accounting knowledge alone. In a healthy function the answer is three or four; in a function that is really a financial controls unit with an audit name, it is fifteen, and the audit committee is getting assurance over a fifth of its risks. The second case is common in companies whose internal audit function was created for SOX and never grew out of it, and it is the reason the question in this guide’s title gets asked by boards as well as by students.
The rest is most of it. A representative audit universe for a mid-sized company has entities in operations (procurement, manufacturing or service delivery, logistics, sales), technology (applications, infrastructure, security, change, resilience, third-party technology), compliance and legal (regulatory obligations, privacy, conduct, ethics), people (hiring, payroll, culture), strategy and governance (planning, major programs, board reporting) and finance. The bank audit universe example shows 126 entities of which the accounting-centred ones are a minority, and the types of internal audits guide lists fifteen kinds of engagement, of which two are financial. Internal auditors spend most of their careers in warehouses, data centres, call centres, trading floors and project rooms, applying the same method (objective, risks, controls, evidence, finding) to things no accountant records.
How the two work together during the year
The professions meet at fixed points in the year, and the quality of the meeting is a fair test of both functions. The table lists the touchpoints and what each side owes the other.
| Touchpoint | What accounting does | What internal audit does | Where it goes wrong |
|---|---|---|---|
| The financial close | Closes the books; posts journals; reconciles; prepares the package | Tests the close controls on a cycle; may observe the close; never posts or approves | Internal audit asked to review journals before posting, which makes it part of the control |
| The external audit | Prepares the schedules; answers the auditors; fixes the adjustments | Coordinates its financial controls work so the external auditor can rely on it; shares findings; receives the management letter | Duplicate testing; internal audit kept away from the management letter |
| SOX or ICFR program | Owns the key controls and the evidence | Tests the controls for management’s assessment, or audits management’s own testing | Management’s assessment built entirely on internal audit’s work, which blurs ownership |
| Budget and forecasting | Builds and owns the numbers | Audits the process (assumptions, approvals, variance review) and uses the numbers as audit evidence elsewhere | Internal audit opining on the forecast rather than the process |
| Fraud and whistleblower matters | Provides the records; may be the subject | Investigates or oversees the investigation; reports to the committee | Accounting investigating its own area |
| Issue remediation | Fixes the control; produces the evidence | Validates the fix before closing the issue | Issues closed on the controller’s assertion |
A week in each job
The clearest way to see the difference is a week at the entry level of each profession, in the same company. The day in the life guide gives the internal audit version at three levels.
| Day | Staff accountant | Staff internal auditor |
|---|---|---|
| Monday | Posts the week’s accruals; clears reconciling items from Friday’s bank reconciliation | Planning meeting for a warehouse audit; reads the inventory policy and last year’s file |
| Tuesday | Prepares the fixed asset roll-forward; answers a question from the external auditors | Interviews the warehouse manager and the receiving supervisor; walks the receiving process |
| Wednesday | Investigates an intercompany difference with the subsidiary accountant | Pulls the receiving and stock-movement data; tests a sample of receipts to purchase orders and stock records |
| Thursday | Books a correcting entry; updates the close checklist | Finds that cycle counts are signed off without a recount of variances; drafts the fact pattern and confirms it with the supervisor |
| Friday | Month-end preparation; runs the preliminary trial balance | Writes the finding with condition, criteria, cause and effect; status note to the in-charge; reads the next engagement’s request list |
Same company, same week, no overlap in the work. The accountant owns a result and makes it right; the auditor owns a conclusion and makes it defensible. People who enjoy the first rarely enjoy the second, and the reverse, which is the real answer to whether an accountant should move into internal audit.
Careers, credentials and pay
For someone with an accounting background, internal audit is a good career on three conditions: that they want breadth over depth, that they can work with people who outrank them, and that they want a destination other than controller or chief financial officer. The table compares the three ladders an accounting graduate usually chooses among.
| Ladder | Path | Hours and pay pattern | Destination | Who it suits |
|---|---|---|---|---|
| Accounting (industry) | Staff accountant, senior, accounting manager, assistant controller, controller, CFO | Month-end and year-end peaks; pay rises with the controller title; CFO is executive pay | Controller or CFO; finance leadership | Depth in one organisation’s numbers; ownership of the result |
| External audit (public accounting) | Associate, senior, manager, senior manager, partner; most leave between senior and senior manager | Busy seasons; pay rises steeply at manager; partner is a different economy | Partner, or an exit to industry accounting or internal audit | Technical depth, client variety, the firm’s training; the transition guide covers the exit to internal audit |
| Internal audit | Staff, senior, manager, director, chief audit executive | No busy season; pay level with industry accounting at the same level and ahead at manager in financial services; CAE is executive pay | Chief audit executive, or chief risk, compliance or operations roles; the exit opportunities guide | Breadth, judgment, the board relationship, variety every quarter |
On credentials: the CPA remains valued in internal audit, particularly for financial services and for the financial reporting slice, and many chief audit executives hold both the CPA and the CIA. The CIA is the profession’s own credential and tests the job itself. The CIA versus CPA comparison weighs them and the certification roadmap sequences them; CPA holders have the accelerated challenge exam route to the CIA.
Moving between the two
Traffic runs both ways. Accountants move into internal audit most often from public accounting after three to five years, and from industry accounting when they want breadth or the board relationship; they bring controls knowledge, documentation discipline and the language of the audit committee, and they have to learn risk-based scoping, operational and technology subject matter, and the consultative relationship with process owners. Internal auditors move into accounting less often, usually into controllership or financial reporting leadership at a company they audited, bringing the controls view and the organisation-wide knowledge, and having to relearn technical accounting at the level a controller needs. The rotation programs that large functions run (two or three years in internal audit, then a move into the business) are the institutional version of the second route and are a reason accounting graduates take internal audit as a first job.
What each side learns from the other is specific. The accountant who becomes an internal auditor learns to scope by risk rather than by account, to treat an interview as evidence to be corroborated rather than an explanation to be recorded, to write for a reader who will act rather than a reviewer who will tick, and to stop at a conclusion rather than at a correct number. The internal auditor who becomes a controller learns the opposite set: that the number has to be right by a date whatever the control environment, that the close is a production process with its own operational risks, and that the audit committee reads the controller’s work with the same scepticism the auditor once applied to it. Both moves take about a year to feel natural, and the people who make them are the ones who can explain each profession to the other.
Misconceptions in both directions
| Misconception | Why people believe it | What is true |
|---|---|---|
| Internal audit checks the accountants’ work | The oldest form of the function did; the name suggests it | Internal audit evaluates the controls over the accounting process among hundreds of others; it does not re-perform the close |
| Internal audit is external audit done by employees | Both use the word audit and some of the same techniques | Different purpose (control effectiveness versus fair presentation), different client (the board versus shareholders), different standards and scope |
| You need a CPA to be an internal auditor | Many internal auditors have one, and some functions prefer it | The CIA is the profession’s credential; information systems, data, engineering and other backgrounds enter without a CPA; the CPA is an advantage for the financial slice and in financial services |
| Internal audit is a finance function | It often reports administratively to the chief financial officer and is budgeted there | It reports functionally to the audit committee and audits finance, including the CFO’s own processes |
| Accountants cannot audit operations or technology | They have not been trained in them | The method transfers; the subject matter is learned on the engagement, which is how every internal auditor learns it |
| Internal audit is a dead end for accountants | The controller ladder is more visible | Internal audit leads to chief audit executive and to risk, compliance and operations leadership, and sees the whole organisation in a way no accounting role does |
| Internal auditors are the police | Findings have consequences | The function reports what the evidence shows and helps management fix it; the police analogy belongs to investigations, a small part of the work |
Worked example: Brightwater Foods asks the question
Brightwater Foods is the illustrative 180-million-dollar food manufacturer used in examples across this site. When its board created an internal audit function for the first time, the controller asked the question in this guide’s title, in the form that matters: would the new function re-do accounting’s work, and would it report through finance? The chief audit executive answered with the first-year plan, built from a risk assessment under the annual risk assessment method.
| Plan area | Engagements | Share of hours | Accounting knowledge required |
|---|---|---|---|
| Financial | Financial close and journal entry controls; procure-to-pay | 22 per cent | High: the close, accruals, three-way match, the ledger |
| Operations | Plant quality and food safety controls; inventory and warehouse; logistics and freight | 28 per cent | Low: cost reports and inventory valuation only |
| Technology | ERP access and change management; backup and resilience; third-party cloud services | 20 per cent | Low: the link from systems to the ledger |
| Compliance and third parties | Supplier food-safety certification and contracts; environmental permits; employment compliance | 15 per cent | None beyond reading contracts |
| Governance and strategy | The new product launch program; board reporting; the risk register | 10 per cent | Business case arithmetic |
| Advisory | Control design for the new ERP module | 5 per cent | Moderate: the process and its accounting |
The plan answered the controller: a fifth of the year touched accounting, none of it re-performed the close, and the function’s charter placed it under the audit committee with the chief executive as administrative line. The first financial engagement found that the controller’s own journal entry approval control had no evidence of review, which the controller fixed within a month and cited at the next board meeting as the reason the function was worth having. The issue validation guide covers how the fix was confirmed.
Frequently asked questions
Is internal audit part of accounting?
No. Internal audit is an independent assurance and advisory function that reports to the board’s audit committee and evaluates governance, risk management and control across the whole organisation. Accounting is a management function that records and reports financial information, and it is one of the processes internal audit evaluates. The two overlap in the financial slice of the audit universe, typically a fifth to a third of a corporate plan.
Do internal auditors need an accounting degree?
No, though it is the most common degree in the profession and the safest route in. Information systems, finance, data, economics, law and other degrees enter, usually into the track where the degree is the specialism. Every internal auditor needs a working command of the accounting concepts that create financial reporting risk: accruals and cut-off, revenue recognition, estimates, valuation and impairment, provisions, internal control over financial reporting, the close, financial statement relationships, and leases and consolidation.
Is internal audit a good career for an accountant?
Yes, if the accountant wants breadth across the organisation, can work with people who outrank them, and wants a destination other than controller or CFO. Hours are steadier than public accounting; pay is level with industry accounting at the same level and ahead at manager in financial services; the top of the ladder is chief audit executive, an executive role, with sideways moves into risk, compliance and operations that accounting roles rarely offer.
What is the difference between internal audit and external audit?
External audit expresses an independent opinion, for shareholders and the public, on whether the financial statements are fairly stated, under auditing standards, from outside the organisation. Internal audit evaluates governance, risk management and control across the whole organisation, for the audit committee and management, under the IIA Standards, from inside it. External auditors may use internal audit’s work on financial controls; the two are otherwise different professions.
Do internal auditors prepare financial statements?
No, and they must not, because the function cannot audit what it owns. Internal audit tests the controls over the processes that produce the statements, from transaction initiation to the ledger to the close, and reports on their effectiveness. Preparing statements, booking entries or owning reconciliations would compromise the independence the Standards require.
Which accounting concepts matter most for an internal auditor?
Accrual basis and cut-off, revenue recognition under the five-step model, accounting estimates and the judgment in them, asset valuation and impairment, provisions and contingencies, internal control over financial reporting under COSO, the close and consolidation, financial statement relationships for analytical review, and leases and the consolidation of entities. Each is where financial misstatement and fraud recur, and each produces a recognisable finding.
Should I get the CIA or the CPA if I work in internal audit?
The CIA, as the profession’s own credential, for anyone staying in internal audit; the CPA as well for those on the financial reporting slice, in financial services, or who may move into accounting leadership. Many chief audit executives hold both. CPA holders have the accelerated one-part CIA Challenge Exam route.
Why does internal audit report to the CFO if it is not accounting?
Usually it does not, in the way the question implies: the functional reporting line, which decides the plan, the ratings and the chief audit executive’s appraisal, runs to the audit committee. The administrative line, which handles budget and logistics, often runs to the CFO or the chief executive. Where the CFO controls the function in substance, examiners, quality assessors and the Standards treat it as an independence problem.
Related guides
- Internal Audit vs External Audit — the professions compared
- Internal Audit vs Compliance — roles, lines and reliance
- The Three Lines Model — where each function sits
- Best Degrees for Internal Audit — the degree choice behind the question
- Internal Auditor Skills — the twelve competencies
- SOX 404 Explained — the financial reporting controls engagement
- Types of Internal Audits — fifteen kinds, of which two are financial
- The Bank Internal Audit Universe — how small the accounting slice is
- CIA vs CPA — which credential for which career
- From External Audit to Internal Audit — the most common route from accounting
- Internal Audit Exit Opportunities — where the career leads
- Internal Audit Basics category — the foundations in one archive
Leave a Reply