“How much does an internal audit cost?” is asked by two different people and deserves two different answers. A CFO or a board member asking about the function wants to know what an internal audit capability costs a company of their size each year, and whether to build, buy, or blend it. A process owner or an audit manager asking about an engagement wants to know what one audit costs, in audit hours, in the auditee’s hours, and in the invoices that arrive when specialists are brought in. Most published answers give a single number for one of those questions and pretend it answers both. This guide builds both from their components, with the arithmetic shown, so that the number you end up with is yours rather than a benchmark from a company that does not resemble you.
It contains a loaded-rate model that turns salaries into an hourly cost, the eight components of an engagement’s total cost, three worked engagement estimates (a 548-hour route cash audit at a distributor, a 250-hour accounts payable audit at a mid-sized company, and a fully outsourced audit at a small company), a table of what the auditee side costs, a function-level cost model at four company sizes with build, co-source, and outsource variants, a cost-driver table showing what makes an audit expensive and what does not, an estimating worksheet you can copy, a section on the cost of the audit against the cost of the risk it examines, and the mistakes that make estimates wrong. It was rewritten in September 2026 with 2026 salary and co-source rate ranges; where a figure is a range it is because the market is a range, and the worksheet is built for you to substitute your own. The staffing and budget decisions behind the function-level figures are covered in the site’s guide to setting up an internal audit function in a small company, and the auditee’s time in the auditee’s guide.
In this guide
- Two questions: the engagement and the function
- Loaded rates: what an audit hour actually costs
- The eight components of an engagement’s cost
- Three worked engagement estimates
- What the audit costs the auditee
- What an internal audit function costs at four company sizes
- Cost drivers: what makes an audit expensive, and what does not
- The estimating worksheet
- The cost of the audit against the cost of the risk
- Common estimating mistakes
Two questions: the engagement and the function
An engagement’s cost is the hours spent on it, by everyone, priced at what those hours cost their employer, plus the cash that leaves the building because of it: specialists, travel, tools. A function’s cost is the annual budget that produces the engagements: salaries and benefits, co-source and outsource fees, technology, training, travel, professional memberships, the external quality assessment every five years, and the overhead the function consumes. The two connect through utilization. A function that costs $1.2 million a year and delivers 7,000 engagement hours has an effective cost of about $170 an engagement hour, which is the number to use when pricing an engagement internally, and it is usually higher than the auditors’ salaries imply because the chief audit executive’s time, training, and the reserve are all in the numerator and not in the denominator. Most functions never compute this figure, and most engagement estimates are therefore understated by a third before they start.
Loaded rates: what an audit hour actually costs
A loaded hourly rate is total employment cost divided by productive engagement hours. Total employment cost is salary plus benefits, payroll taxes, and the share of occupancy, technology, and administration attributable to the role, which in most US companies runs 25 to 40 percent on top of salary; 30 percent is used below. Productive engagement hours are what is left after leave, training, administration, and, for managers, supervision, which is why the same salary produces very different rates at different levels. The table uses 2026 US salary ranges for a mid-sized company outside the highest-cost cities; adjust for your market, and note that financial services and the largest metros run 20 to 40 percent higher.
| Role | Salary range (2026, US mid-market) | Loaded cost at 30 percent | Productive engagement hours | Loaded rate per engagement hour |
|---|---|---|---|---|
| Staff auditor (0 to 3 years) | $65,000 to $85,000 | $85,000 to $110,000 | 1,500 | $57 to $74 |
| Senior auditor (3 to 6 years, often CIA or CPA) | $90,000 to $120,000 | $117,000 to $156,000 | 1,500 | $78 to $104 |
| IT auditor (senior) | $105,000 to $140,000 | $137,000 to $182,000 | 1,500 | $91 to $121 |
| Audit manager | $130,000 to $165,000 | $169,000 to $215,000 | 1,300 | $130 to $165 |
| Chief audit executive (mid-sized company) | $180,000 to $260,000 | $234,000 to $338,000 | 700 | $334 to $483, but see below |
| Blended internal rate, six-person function (all costs, all engagement hours) | — | About $1.1 million total | About 8,000 | About $140 |
| Co-source, boutique or regional firm | — | — | — | $150 to $250 |
| Co-source, national or Big Four firm, senior staff | — | — | — | $225 to $400; partners and specialists higher |
| Specialist (ERP security, cybersecurity, actuarial, model validation) | — | — | — | $250 to $500 |
The chief audit executive row shows why per-role rates mislead: priced on their own 700 engagement hours the CAE costs more than a Big Four partner, but the CAE’s cost is really a cost of running the function, and the sensible treatment is to spread it across all engagement hours, which is what the blended rate does. The blended rate is the number to use for internal estimates. For a six-person function with the salary mix above, training and technology of about $60,000, travel of $40,000, and memberships and the amortized external assessment of about $20,000, total cost lands near $1.1 million and engagement hours near 8,000, so about $140 an hour; the derivation for a specific function is in the audit planning guide, whose capacity model is the denominator. Co-source rates are quoted per hour but bought in blocks, and the effective rate on a fixed-fee engagement is what matters; a $45,000 fixed fee for a 180-hour ERP security review is $250 an hour regardless of the rate card.
The eight components of an engagement’s cost
An engagement’s total cost has eight components, and most estimates count two of them. The table lists all eight with how each is measured and the share of the total each typically represents in a mid-sized process audit; the shares are there to show what is being left out when only audit hours are counted, which is usually 40 to 50 percent of the true figure.
| Component | How it is measured | Typical share of total cost | Usually counted? |
|---|---|---|---|
| 1. Internal audit hours: planning, fieldwork, reporting, review | Timesheet hours by role x loaded rate, or total hours x blended rate | 40 to 55 percent | Yes, but often at salary rate rather than loaded rate |
| 2. Co-source and specialist fees | Invoices; fixed fee or hours x rate | 0 to 30 percent, depending on the engagement | Yes |
| 3. Auditee hours: coordinator, performers, managers, executives | Estimated hours by role x their loaded rates; see the auditee section | 20 to 35 percent | Rarely, and never in the audit function’s budget |
| 4. Supporting functions: IT extracts, HR records, finance data | Hours x loaded rate | 2 to 5 percent | Rarely |
| 5. Travel and site costs | Actual expenses | 0 to 10 percent; higher for multi-site work | Yes |
| 6. Tools and data: analytics licenses, data extraction, secure file transfer | Allocated share of annual cost, or direct cost for one-off tools | 1 to 3 percent | Sometimes |
| 7. Follow-up and validation hours in later periods | Hours x blended rate, typically 10 to 15 percent of original engagement hours | 5 to 8 percent | Rarely attributed to the engagement |
| 8. Management and committee time consuming the results | Executive and director hours reading, discussing, and responding | 2 to 4 percent | Never |
Whether components 3, 4, and 8 belong in “the cost of the audit” is a fair question, and the answer depends on who is asking. A CFO deciding whether to authorize a discretionary review wants the total, because the auditee hours are real hours the business will lose. An audit committee approving the function’s budget wants components 1, 2, 5, and 6, because those are the budget. The estimates below show both, because the honest answer to “what will this audit cost us” includes the business’s own time, and a function that says so earns credibility with the executives whose time it is.
Three worked engagement estimates
The three engagements below span the range most readers will meet: a large multi-site audit by an in-house function, a standard process audit at a mid-sized company, and a fully outsourced audit at a company with no function of its own. Each is costed on all eight components, with the audit-budget subtotal (what the function pays) separated from the total (what the company pays). The first is MidState Beverage’s FY27-01 route cash audit, which ran 548 hours against 520 planned and covered twelve depots, 300 routes, and 37,400 settlements.
| Component | A. Route cash audit, 12 depots, in-house six-person function (MidState FY27-01) | B. Accounts payable audit, one entity, in-house four-person function | C. Payroll and expenses audit, 400-person company, fully outsourced to a regional firm |
|---|---|---|---|
| 1. Internal audit hours | 548 hours at the $140 blended rate: $76,700 (manager 90, two seniors 320, staff 98, IT auditor 40 for analytics) | 250 hours at a $125 blended rate: $31,250 | None; a finance manager spends 30 hours managing the engagement: $2,400 at $80 |
| 2. Co-source and specialist fees | None | None | Fixed fee $38,000 for a 160-hour engagement (effective $238 an hour), including the report |
| 3. Auditee hours | 12 depot managers at 20 hours, 24 settlement clerks at 8 hours, 3 regional finance staff at 30 hours, operations VP 16 hours, 60 drivers at 1 hour: 598 hours, about $46,000 at role-weighted loaded rates | AP manager 40, two clerks 32, controller 12, CFO 4, IT 8: 96 hours, about $8,600 | Payroll manager 30, HR 16, CFO 6, IT 8: 60 hours, about $6,200 |
| 4. Supporting functions | IT extracts of settlement and deposit data, 24 hours: $2,400 | IT extract, 6 hours: $600 | Included above |
| 5. Travel | Four depot visits, two of them overnight for two auditors: $6,800 | None | Firm’s travel capped in the fee at $1,500 |
| 6. Tools and data | Analytics platform allocation for one month plus secure transfer: $1,200 | $400 | Included in the fee |
| 7. Follow-up and validation (later periods) | 11 actions across two validation windows, 80 hours: $11,200 | 4 actions, 24 hours: $3,000 | Follow-up review by the firm, fixed at $6,000 |
| 8. Management and committee time | CFO, CEO, operations VP, committee: 24 hours, about $6,000 | 10 hours, about $2,000 | 8 hours, about $1,800 |
| Audit budget subtotal (components 1, 2, 5, 6, 7) | $95,900 | $34,650 | $47,900 |
| Total cost to the company (all eight) | $150,300 | $45,850 | $55,900 |
| Total per audit hour | $274 per internal audit hour | $183 per internal audit hour | $349 per firm hour |
Three observations. The auditee side of the route cash audit was larger than the audit side in hours and about 60 percent of its cost, which is typical of multi-site operational work and is the figure to quote when a depot manager asks what the audit will cost them. The outsourced audit is the cheapest in audit-budget terms if the company needs only one or two audits a year, and the most expensive per hour, which is the trade-off the function-level table below makes explicit. And the follow-up component is real money that almost no function attributes to the engagement that created it; MidState’s eleven actions cost 80 hours to validate, which is 15 percent of the original fieldwork and should be in the estimate from the start, as the issue validation guide argues.
What the audit costs the auditee
The auditee’s cost is the component executives feel and audit functions ignore, and estimating it well is a courtesy that pays back in cooperation. For a department that is the sole subject of a 300- to 400-hour process audit, the auditee side runs 80 to 130 hours across the phases, concentrated in the request list and fieldwork. The table gives the profile by role and phase for a department of about twenty people, with the loaded cost at typical mid-market rates; a site inside a multi-site audit carries roughly half.
| Auditee role | Planning and request list | Fieldwork | Closing, response, report | Follow-up and validation | Total hours | Loaded cost |
|---|---|---|---|---|---|---|
| Department manager ($95 loaded) | 8 | 12 | 12 | 8 | 40 | $3,800 |
| Audit coordinator ($60) | 16 | 16 | 4 | 6 | 42 | $2,520 |
| Process performers, combined ($50) | 4 | 16 | 2 | 4 | 26 | $1,300 |
| Executive ($250) | 2 | 1 | 4 | 2 | 9 | $2,250 |
| IT or finance support ($85) | 6 | 4 | 0 | 2 | 12 | $1,020 |
| Total | 36 | 49 | 22 | 22 | 129 | $10,890 |
Two levers reduce this figure without reducing assurance. A precise request list, numbered and with the purpose of each item stated, cuts the coordinator’s hours by a third, because the largest auditee cost is producing documents the auditors did not need or producing the right ones twice. And direct data access, where the auditors extract from the system themselves under read-only credentials, removes most of the IT support hours and, not incidentally, improves the evidence. The auditee’s guide gives the same table from the auditee’s side, with what each phase asks of them.
What an internal audit function costs at four company sizes
The function-level question is a staffing question, and the honest answer is a range that depends on regulation, geography, and the board’s appetite for assurance more than on revenue. The table gives 2026 US mid-market figures for four company sizes under three sourcing models: build (in-house staff with specialist co-source), blend (a small in-house core with substantial co-source), and buy (fully outsourced under a chief audit executive role held by an executive or a firm). The engagement hours column is what the money buys, and the cost per engagement hour is the comparison that matters; the figures are illustrative and every organization should build its own from the loaded-rate model above.
| Company profile | Model | Staffing | Annual cost | Engagement hours delivered | Cost per engagement hour | Notes |
|---|---|---|---|---|---|---|
| $50M to $150M revenue, private, unregulated | Buy | Outsourced function, 4 to 6 engagements a year; CFO or committee chair as sponsor | $150,000 to $300,000 | 600 to 1,000 | $250 to $300 | Cheapest absolute cost; no institutional knowledge; independence depends on the firm reporting to the committee, not the CFO |
| $150M to $400M revenue, private with lenders or PE-backed | Blend | One head of internal audit plus 600 co-source hours | $330,000 to $400,000 | 1,500 to 1,700 | $210 to $250 | The model most first functions adopt; specialist coverage bought as needed |
| $400M to $1B revenue, private or newly public | Build | Three to four in-house auditors including an IT auditor, plus specialist co-source | $600,000 to $900,000 | 4,000 to 5,500 | $140 to $170 | Enough depth for ICFR support and continuous analytics |
| $1B to $3B revenue, public or regulated | Build | Six to nine auditors, co-source for specialists and surge | $1.1 million to $1.9 million | 8,000 to 12,500 | $130 to $155 | MidState’s six-person function sits at the bottom of this band on cost and delivers about 8,000 hours |
| Any size, regulated financial institution | Build, with heavy co-source | Add 30 to 60 percent to the staffing above for regulatory coverage, model risk, and IT | Add 40 to 80 percent | — | Higher; specialist rates dominate | Regulators expect coverage the risk assessment alone would not justify |
The cost per engagement hour falls as the function grows because the fixed cost of the chief audit executive and the methodology is spread over more hours, and it rises again in regulated institutions because the work needs specialists. The break-even between buying and building is usually around 1,500 engagement hours a year: below that, a firm’s rate card is cheaper than a head of audit’s loaded cost; above it, the in-house model wins on cost and on the knowledge that accumulates. The choice is rarely made on cost alone, and the site’s co-sourcing versus outsourcing comparison covers the independence, regulatory, and continuity considerations that decide it; the co-sourcing guide covers how to buy the hours well once the model is chosen.
Cost drivers: what makes an audit expensive, and what does not
Audit cost is driven by a short list of variables, and most of them are set at planning. The table separates the drivers that should raise cost, because they raise the assurance the conclusion needs, from the ones that raise cost without raising assurance, which are the ones to attack. The distinction matters because the wrong cost-cutting, smaller samples and fewer sites on a high-risk engagement, reduces the value of the report faster than it reduces the bill; the site’s audit risk guide explains why.
| Driver | Effect on cost | Legitimate? | What to do about it |
|---|---|---|---|
| Residual risk of the area | High-risk areas need lower detection risk: larger samples, more sites, more re-performance | Yes; this is the cost of a conclusion worth having | Price it in the plan and say why; do not cut it |
| Number of sites, entities, and systems | Each additional location or system adds walkthroughs, travel, and sample coverage | Yes, up to a point | Analytics across all locations plus site visits at a rotation; remote walkthroughs where custody is not at issue |
| Scope creep | Objectives added mid-engagement without hours | No | Scope fixed in the planning memo; additions become a separate engagement or a documented change with hours |
| Poor request-list discipline | Documents produced twice, chased for weeks, or never needed | No | Numbered list with purposes; direct data access; a daily 15-minute check-in during fieldwork |
| Sampling by habit | Twenty-five items on every control regardless of risk | No | Sample sizes set from residual risk and frequency; analytics where the risk can be expressed as a rule |
| Testing controls that failed design | Operating-effectiveness hours on a control that cannot work | No | Stop at the design conclusion; redirect hours to substantive work |
| Report drafting cycles | Four drafts, each reviewed by three people | No | Findings agreed at the closing meeting; one draft to management; a fixed template |
| Specialist skills | Co-source at $250 to $500 an hour for ERP security, cyber, models | Yes, where the skill is needed for the conclusion | Buy hours for the specialist question only; internal staff do the surrounding work |
| Travel | Multi-site work with overnight stays | Partly | Cluster visits; unannounced visits where custody matters; remote for the rest |
| Auditee readiness | Missing documentation, undocumented processes, staff turnover | It is the finding, not a cost to avoid | Report it as a finding; do not absorb it by extending fieldwork indefinitely |
| Tooling | Analytics platforms, workpaper systems | Yes, where used | A spreadsheet and a shared drive serve a small function; buy tools when the volume justifies them |
| Review and supervision | Manager and CAE review hours on every workpaper | Yes; review is a control over audit quality | Review at milestones rather than continuously; a reviewer checklist on the index |
The largest single lever in most functions is analytics, and not because software is cheap. A full-population test of settlements or payments replaces a site-by-site sample for the conditions it can express, costs a fraction of the hours once the extract is built, and produces a stronger conclusion; MidState’s route cash analytics took 40 IT-auditor hours to build and covered twelve depots that would otherwise have needed twelve visits. The site’s accounts payable analytics and journal entry analytics catalogs show what the tests look like.
The estimating worksheet
The worksheet below produces the audit-budget subtotal and the total cost to the company for any engagement in about twenty minutes, and it belongs in the planning memo so that the committee sees the cost next to the objective. The hours rows are estimated by phase and role; the rates come from the loaded-rate model; the auditee rows from the auditee table. The example column is the accounts payable audit from the worked estimates.
| Line | How to estimate | Example: AP audit |
|---|---|---|
| Planning hours (risk assessment, memo, request list, kickoff) | 15 to 20 percent of fieldwork hours | 35 hours |
| Fieldwork hours (walkthroughs, testing, analytics) | From the work program: walkthrough hours by process tier plus test hours by control and sample size plus analytics build and run | 150 hours |
| Reporting hours (findings, closing, draft, final) | 20 to 25 percent of fieldwork hours | 35 hours |
| Review and supervision hours | 15 to 20 percent of the above | 30 hours |
| Total internal hours | Sum | 250 hours |
| Blended internal rate | Function cost divided by engagement hours | $125 |
| Internal audit cost | Hours x rate | $31,250 |
| Co-source and specialist fees | Quotes or hours x rate | $0 |
| Travel and site costs | Itinerary | $0 |
| Tools and data | Allocation or direct | $400 |
| Follow-up and validation (later periods) | 10 to 15 percent of fieldwork hours x rate | $3,000 |
| Audit budget subtotal | Sum of the five lines above | $34,650 |
| Auditee hours and cost | From the auditee table, scaled to the department | 96 hours; $8,600 |
| Supporting function cost | IT, HR, finance hours x rate | $600 |
| Management and committee time | Hours x executive rate | $2,000 |
| Total cost to the company | Subtotal plus the three lines above | $45,850 |
| Contingency | 10 percent of the subtotal for a first-time area; 5 percent for a repeat | $3,465 (first time) |
| Cost per conclusion | A sanity check: what the company pays to know whether this area’s controls work | About $49,000 for a process paying out $60 million a year |
The last line is the one to put in front of a skeptical executive. An audit that costs $49,000 all-in to conclude on a process that disburses $60 million a year is eight basis points of the flow it examines, and the comparison reframes the question from “why does audit cost so much” to “what level of assurance on $60 million of payments is worth $49,000.” The planning memo template has a place for the worksheet, and the work program guide shows how the fieldwork hours are built up from the tests.
The cost of the audit against the cost of the risk
Audit cost has to be judged against something, and the right comparison is the exposure the engagement examines, not the audit budget of a peer company. Three framings work with boards. The first is the flow-through comparison used above: audit cost as a share of the value the process handles, which for most process audits lands between two and fifteen basis points. The second is the loss comparison: MidState’s route cash audit cost about $150,000 all-in; the Dayton diversion it was prompted by was $18,400 over five months from one of 300 routes, the analytics found 1,412 self-approved variance overrides across the year, and the settlement reconciliations at nine of twelve depots had no independent reviewer, so the plausible exposure being controlled was some multiple of the known loss every year, and the audit was a one-time cost that produced a permanent change in the control design. The third is the assurance comparison: what the alternative sources of assurance cost, which for a lender covenant package might be an external assurance engagement at two to four times the internal cost, and for a regulated entity might be an examination finding whose remediation program costs more than a decade of audit budget.
What the framing should not do is claim that the audit “saved” a specific sum. Audit functions that report cost savings as a headline metric end up chasing the number, and the number is unprovable: a diversion that did not happen because a control now exists cannot be measured, and a finding’s remediation cost is management’s cost, not audit’s saving. The honest statement is that the engagement cost a known amount, produced a stated level of assurance over a stated exposure, and changed specific controls, which is the form the site’s guide to measuring a new function recommends for committee reporting, and which the fraud red flags library helps to express in terms of the schemes a control set does and does not address.
Common estimating mistakes
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Salary rate instead of loaded rate | Hours priced at $55 for a senior auditor whose true cost is $95 and whose function’s blended cost is $140 | Every estimate understated by 40 to 60 percent; the function’s budget never reconciles to its engagements | Compute the blended rate once a year and use it everywhere |
| Ignoring the auditee | Cost estimate with no business hours in it | The company’s true cost is understated by a quarter to a third; executives notice | Estimate auditee hours by role and phase; tell the auditee |
| Follow-up unbudgeted | Validation done from whatever time is left | Findings unvalidated; the engagement’s true cost understated by 10 to 15 percent | Validation hours in the estimate and in the plan |
| Fixed fees compared with rate cards | A $38,000 fixed fee judged cheap against a $300 rate card without counting the hours | Effective rates are what matter; a fixed fee for 100 hours is $380 an hour | Divide every fee by the hours it buys |
| Benchmarking to peers by revenue | “Companies our size spend X percent of revenue on internal audit” | Regulation, geography, and risk profile drive cost more than revenue | Build the cost from the capacity model and the coverage cycle; use benchmarks only as a sanity check |
| Cutting depth to cut cost | A high-risk engagement’s sample sizes and sites reduced to fit the budget | The conclusion is weaker than the report implies; assurance falls faster than cost | Cut scope explicitly, list what is not covered, keep the depth on what is |
| Absorbing auditee unreadiness | Fieldwork extended for weeks while the auditee finds documents | Cost overruns that hide a finding about documentation | Time-box the request list; report gaps as findings |
| Specialists doing generalist work | A $350-an-hour ERP specialist walking the AP process | Paying specialist rates for work internal staff can do | Scope the specialist to the specialist question |
| No contingency on first-time areas | An area never audited estimated as if it were a repeat | First-time audits run 20 to 40 percent over because nothing is documented | 10 percent contingency for first-time work, stated in the memo |
| Claiming savings | “Internal audit saved $2.3 million this year” | Unprovable; distorts the plan toward recoverable findings | Report cost, assurance delivered, and controls changed |
The cost of an internal audit is knowable to within ten percent before it starts, if the estimate counts all eight components at loaded rates and the scope is fixed in the planning memo. The cost of an internal audit function is a staffing decision made once and revisited annually, and it is best made from a capacity model rather than a benchmark. Both numbers are worth stating plainly to the people who pay them, because a function that can say what it costs and what the money buys is a function whose budget the committee understands. The guides by role page collects the audit manager and CAE material this guide draws on.
Related guides
- Setting up an internal audit function in a small company — the staffing and budget decisions behind the function-level figures
- How to build an internal audit plan — the capacity model that gives the blended rate its denominator
- Co-sourcing vs. outsourcing — the build, blend, or buy decision beyond cost
- Internal audit co-sourcing 101 — buying specialist hours well
- The auditee’s guide — the auditee’s hours from their side
- Audit risk explained — why depth should follow risk, not budget
- Audit planning memo template — where the estimate is recorded
- Audit work program — building fieldwork hours from tests
- Issue validation — the follow-up cost most estimates omit
- Accounts payable analytics — the largest cost lever in practice
- All Guides — the full index
Leave a Reply