Internal audit, the Sarbanes-Oxley (SOX) program, the compliance function and enterprise risk management (ERM) are the four functions most organizations maintain to make sure risks are identified, controls work and the law is followed, and from the outside they look alike: each assesses risk, each tests or monitors controls, each tracks issues and each reports to a committee. They are not alike. They have different mandates, answer to different principals, sit on different lines of the Three Lines Model, and produce different things for different readers. Where the differences are understood, the four form a system in which each relies on the others; where they are not, the organization gets four risk assessments, three sets of control tests on the same reconciliation, two issue logs that disagree and a board that cannot tell which function’s “high” is highest.
This explainer gives the map that everyone should have on day one. It covers each function’s mandate, reporting lines, Three Lines placement, outputs and readers; a one-page comparison table; the five overlap zones where turf wars start and how each is settled; the interaction model that turns four functions into one control system; how the picture varies by organization size and sector; the questions a new joiner should ask to find out which version their organization runs; and a worked example of a regional bank writing the operating agreement between its four functions after a year in which the same reconciliation was tested by three of them. It builds on the Three Lines Model guide, the internal audit versus compliance comparison and the what are internal controls and who tests them primer.
In this guide
- The one-page comparison
- Internal audit
- The SOX program
- Compliance
- Enterprise risk management
- The fifth party: the external auditor
- Where each sits in the Three Lines Model
- The five overlap zones, and how to settle each
- The interaction model: four functions, one system
- Variations by size and sector
- Questions to ask on day one
- Failures that make four functions worse than one
- Worked example: Lakeshore Bancorp writes the operating agreement
- Questions about the four functions
- Related guides
The one-page comparison
| Dimension | Internal audit | SOX program | Compliance | Enterprise risk management |
|---|---|---|---|---|
| Mandate | Independent, objective assurance and advice on governance, risk management and control, across the whole organization | Management’s assessment of internal control over financial reporting (ICFR) required of public companies by Section 404, plus the certifications under 302 | Ensure the organization meets its legal and regulatory obligations and its code of conduct; advise, monitor, investigate, report | Identify, assess, respond to and report enterprise risks against the board’s appetite; maintain the framework others use |
| Principal | The board, through the audit committee | The chief executive and chief financial officer, who certify | Management, with a reporting line to the board or a committee for independence | Management (often the chief risk officer), reporting to the board risk committee |
| Reporting lines | Functionally to the audit committee; administratively to the CEO | To the CFO or controller; results to the audit committee | To the general counsel, CEO or CRO; access to the audit or risk committee | To the CRO, CFO or CEO; to the board risk committee |
| Three Lines placement | Third line | First line (control owners) with a second-line program office; sometimes run by internal audit, with consequences | Second line | Second line |
| Scope | Everything in the audit universe, risk-based | Financial reporting controls over material accounts and disclosures | Legal and regulatory obligations; conduct; ethics | All risk categories at enterprise level; the framework |
| Main outputs | Audit plan; engagement reports with findings and ratings; annual opinion; issue validation | Scoping; risk and control matrices; test results; deficiency evaluation; management’s assessment | Compliance risk assessment; policies; monitoring and testing results; training; investigations; regulatory reporting | Risk appetite; taxonomy; register; RCSA results; KRIs; board risk report |
| Who relies on the output | Audit committee; management; external auditor; regulators | CEO and CFO for certification; external auditor for attestation; audit committee | Management; board; regulators | Board; management; internal audit for planning |
| Independence | Required: no operational responsibility; safeguards for advisory work | Not independent: it is management’s own assessment | Independent of the business lines it monitors; part of management | Independent of risk-taking units; part of management |
| Tests controls? | Yes, as assurance, on a risk-based sample of the universe | Yes, management’s testing of ICFR key controls each year | Monitors and tests compliance controls | Usually not; relies on self-assessment and the other functions’ results |
| Standards | Global Internal Audit Standards | SEC rules; PCAOB AS 2201 for the auditor; COSO 2013 | Sector regulation; DOJ compliance program guidance; ISO 37301 | COSO ERM 2017; ISO 31000 |
Internal audit
Internal audit is the only one of the four that is independent of management by design. Its mandate comes from the board through the internal audit charter, its chief audit executive reports functionally to the audit committee (the CAE guide covers the arrangement), and its scope is the whole organization, including the other three functions, which it audits as it audits any other activity. It provides assurance (an independent conclusion on whether governance, risk management and controls are adequate and effective) and advice (facilitation, consulting, insight) with safeguards that keep the advice from compromising the assurance. It does not own risks, controls, policies or compliance; when it is given any of them, as happens in small organizations where internal audit runs the SOX program or facilitates ERM, its independence over that area is impaired and the impairment must be disclosed and managed. Its output is read by the audit committee first, which is what distinguishes its findings from everyone else’s: the other three report to management about management; internal audit reports to the board about management. The Domain I and independence guides give the foundations; the assurance versus advisory guide covers the two modes.
The SOX program
The SOX program is management’s own machinery for meeting Sections 302 and 404 of the Sarbanes-Oxley Act: scoping the financial reporting process to the material accounts and disclosures, documenting the key controls in risk and control matrices, testing their design and operating effectiveness, evaluating deficiencies, and supporting the chief executive’s and chief financial officer’s certifications and management’s annual assessment of internal control over financial reporting, which the external auditor attests for accelerated filers. It is narrow (financial reporting only), deep (every key control tested every year) and not independent (it is management assessing itself, which is why the external auditor attests). It usually sits in finance as a program office under the controller or CFO, with the control owners in the first line performing and evidencing their controls and the program office coordinating, testing and reporting. Some organizations house the SOX testing in internal audit, which is efficient and costs the function its independence over financial reporting controls unless the testing is clearly labeled as a management service and the function’s assurance work over the same area is done separately. The SOX 404, 302 versus 404 versus 906 and scoping guides cover the program; the SOX for control owners guide covers the first line’s part.
Compliance
Compliance is the second-line function responsible for the organization’s adherence to laws, regulations and its own code: it maintains the obligations inventory and the compliance risk assessment, writes or owns the policies that translate obligations into requirements, advises the business, trains, monitors and tests compliance controls, handles regulatory change, manages the hotline and investigations, and reports to management, the board and regulators. In regulated sectors it is large and specialized (a bank’s compliance department covers consumer protection, financial crime, fair lending, privacy and more; the banking guide describes one of forty people); elsewhere it may be the general counsel’s office. It is part of management and not independent in the audit sense, but it must be independent of the business lines it monitors, with a reporting line that protects it (to the general counsel, the CEO or the CRO, with access to a board committee). It tests controls, which is where it overlaps with internal audit and SOX; the difference is that compliance tests to manage the risk and internal audit tests to assure the board that it is managed. The internal audit versus compliance guide draws the line in detail; the conduct risk guide shows the function’s behavioral frontier.
Enterprise risk management
ERM is the second-line function that maintains the organization’s risk framework and produces its enterprise view of risk: the taxonomy, the appetite statement and its cascade, the register, the RCSA process, the KRI program, scenario analysis and the board risk report. It does not usually test controls; it relies on the first line’s self-assessment, on compliance’s and SOX’s testing and on internal audit’s results to form its view of the control environment, and it aggregates. In financial institutions it is a large function under a chief risk officer with sub-frameworks for credit, market, liquidity, operational and model risk; in a mid-size company it may be one person in finance, and in small ones it is often facilitated by internal audit with the independence consequences the ERM audit guide describes. Its reader is the board risk committee (or the audit committee where no risk committee exists), and its distinctive product is the aggregated profile against appetite that none of the other three can produce because none of them sees the whole.
The fifth party: the external auditor
The external auditor is not one of the four but is in every room with them, and the map is incomplete without its place. It is engaged by and reports to the audit committee, audits the financial statements and, for accelerated filers, attests management’s assessment of internal control over financial reporting, which means it tests the same ICFR controls the SOX program tests and may rely on the SOX program’s and internal audit’s work under the auditing standards (PCAOB AS 2201 and AS 2605 govern the extent) when it has assessed their competence and objectivity. It does not audit compliance or ERM as such, though it considers laws and regulations with a direct effect on the financial statements and reads the risk disclosures. The overlap zone that matters is control testing: a coordinated year has the SOX program test key controls on a schedule the external auditor can rely on, internal audit cover the areas the auditor will not reach, and all three agree the timetable in the first quarter, which the audit committee calendar‘s third-quarter reliance discussion records. The internal versus external audit guide covers the broader comparison; the point for this map is that the external auditor’s reliance on internal audit depends on the same independence the SOX-testing arrangement puts at risk, so a function that tests SOX controls for management may find the external auditor relying on it less, not more.
Where each sits in the Three Lines Model
| Line | Role in the Model | Function | Why there |
|---|---|---|---|
| First line | Management’s delivery of products and services and management of the associated risks and controls | Control owners who perform SOX controls; business compliance officers embedded in units; risk owners who complete RCSAs | They own the risks and operate the controls |
| Second line | Management’s expertise, support, monitoring and challenge on risk matters | Compliance; ERM; the SOX program office (as management’s testing and coordination role); other risk functions | They set frameworks, monitor and challenge the first line, and report to management and the board; they are still management |
| Third line | Independent and objective assurance and advice | Internal audit | Accountable to the governing body, independent of management’s responsibilities |
| Outside the lines | External assurance providers | External auditor (attesting ICFR, auditing the financial statements); regulators; certification bodies | Not part of the organization; the Model notes their role |
Two placements are often argued. The SOX program office is sometimes described as first line because it works for the CFO who owns the controls, and sometimes as second line because it monitors and tests the control owners; the Model’s role-based reading resolves it, since the office performs a second-line role (monitoring and challenge) on behalf of management regardless of where it sits on the chart. Compliance in a small company that also performs controls (filing the regulatory returns it is supposed to oversee) is performing a first-line role for those returns and a second-line role for everything else, and should say so. The 2020 Model’s insistence that the lines are roles rather than organizational units matters here: a SOX program run by internal audit is a second-line role performed by the third-line function, and the Model’s answer is that the role, not the department, determines the independence consequence. The Three Lines guide covers the principles; the point for this map is that only one of the four functions is on the third line, and three of them are management.
The five overlap zones, and how to settle each
| Zone | What overlaps | How turf wars start | Settlement |
|---|---|---|---|
| 1. Risk assessment | ERM’s enterprise assessment; compliance’s compliance risk assessment; SOX’s financial reporting scoping; internal audit’s annual audit risk assessment | Four assessments with four scales and four answers to “what are our top risks” | One taxonomy and one rating scale; each function’s assessment is a view through that taxonomy for its purpose; ERM aggregates; internal audit uses the others as inputs and keeps its own judgment |
| 2. Control testing | SOX tests ICFR key controls; compliance tests compliance controls; internal audit tests on a risk basis; the external auditor tests ICFR | The same reconciliation tested three times; owners interviewed by three teams in one quarter | An assurance map (the worked example) showing who tests what; internal audit relies on SOX and compliance testing where it has assessed their quality, under Standard 9.5’s coordination and reliance; a shared testing calendar |
| 3. Issue tracking | SOX deficiencies; compliance findings; ERM treatment actions; internal audit findings; regulatory findings | Five logs; one issue closed in one and open in another; the board sees different counts | One issue management system with the source tagged; one severity scale; closure evidence standards agreed; internal audit validates the significant ones (tracking guide) |
| 4. Policy ownership | Compliance owns conduct and regulatory policies; ERM owns the risk policy; SOX owns control documentation standards; internal audit owns its methodology and nothing else | Internal audit asked to write the policies it will audit; compliance and ERM both claiming the risk appetite | A policy register with one owner per policy; internal audit advises and never owns operational policy; appetite owned by ERM and approved by the board |
| 5. Board reporting | Each function reports to a committee in its own format | Four packs with four ratings vocabularies; the committee cannot compare | A shared rating vocabulary; a combined assurance view presented to the audit committee (the calendar places it); internal audit’s annual opinion draws on the others’ results and says so |
The interaction model: four functions, one system
The four work as a system when each takes the others’ output as input and gives its own back. ERM supplies the taxonomy, the appetite and the enterprise risk assessment; compliance and SOX use the taxonomy to classify their findings and the appetite to rate them; internal audit uses the ERM assessment as one input to its own and audits the framework that produced it. Compliance and SOX test controls within their mandates and share results through the shared issue system; internal audit assesses the quality of their testing and, where it is reliable, scopes its own work to avoid duplication, extending its coverage to the areas nobody else reaches; ERM takes the testing results as its view of the control environment. Internal audit’s findings on compliance and SOX controls feed their programs’ next cycles; its findings on the ERM framework improve the assessments everyone else uses. The board receives one combined picture: ERM’s profile against appetite, SOX’s assessment of financial reporting controls, compliance’s view of regulatory exposure and internal audit’s independent opinion on all three, in a shared vocabulary. The mechanism that makes this happen is a written operating agreement (the worked example below) and a standing coordination meeting between the four heads, with the assurance map as the shared document; the KPI guide suggests measuring the duplication the system removes.
Variations by size and sector
| Organization | How the four appear | Watch for |
|---|---|---|
| Large bank or insurer | All four as substantial separate functions; ERM under a CRO with sub-frameworks; compliance of dozens to hundreds; SOX as a program office in finance; internal audit assuring all three | Coordination failures from scale; duplicated testing; four vocabularies |
| Mid-size public company | Internal audit of five to twenty; SOX program in finance, sometimes tested by internal audit; compliance under the general counsel; ERM a small team or one person in finance or risk | Internal audit running SOX testing; ERM facilitated by internal audit; impairments undisclosed |
| Private company | No SOX; internal audit small or co-sourced; compliance as the general counsel’s office; ERM informal | Internal audit asked to be all four; a board that thinks it has four functions when it has one |
| Not-for-profit or public sector | Internal audit often mandated; compliance tied to grants and statute; ERM developing; no SOX but equivalent control statements | Compliance confused with internal audit by the board |
| Technology or SaaS company | SOX arrives at IPO (the readiness guide); compliance centered on privacy and security certifications; ERM young; internal audit built late | Security compliance (SOC 2, ISO 27001) treated as the whole of compliance; internal audit confused with the SOC 2 auditor |
Questions to ask on day one
A new auditor, control owner or director can find out which version of the map their organization runs with seven questions. Who does the chief audit executive report to, functionally and administratively? Who tests the SOX key controls, and if it is internal audit, how is the assurance work over financial reporting kept separate? Who owns the risk appetite statement and the taxonomy, and does everyone use them? Is there one issue management system or several? Who facilitates the risk assessments, and is that disclosed? Is there an assurance map or a coordination agreement between the functions? And what does the audit committee receive from each function, in what vocabulary? The answers place the organization on the variations table, and the job description and first 90 days guides suggest asking them in the first week rather than discovering them in the first turf war.
Failures that make four functions worse than one
| Failure | How it shows | Fix |
|---|---|---|
| Four vocabularies | “High” means four things; the board cannot compare | One taxonomy, one rating scale, one severity scale |
| Triple testing | Control owners interviewed by SOX, compliance and internal audit in the same quarter about the same control | Assurance map; reliance where quality is assessed; shared calendar |
| Independence erosion | Internal audit owns SOX testing, facilitates ERM and drafts compliance policies, and audits all three | Disclose, safeguard, and over time move the management roles to management |
| Assurance gaps | Each function assumes another covers an area; nobody does | The map shows the white space |
| Issue chaos | Five logs, inconsistent status, different counts to the board | One system, source-tagged |
| Reporting by volume | Each function proves its worth by the number of findings | Combined assurance reporting; measure duplication removed, not findings produced |
| Board confusion | Directors think compliance is independent assurance, or that internal audit guarantees compliance | The one-page table in the board’s induction pack |
Worked example: Lakeshore Bancorp writes the operating agreement
Lakeshore Bancorp, the $9 billion publicly traded regional bank used in examples across this site, runs all four functions at scale: a 22-person internal audit function reporting to the audit committee; a SOX program office of five in finance with 212 key controls and 46 sub-certifying managers; a compliance department of about forty under a chief compliance officer reporting to the chief risk officer with access to the audit committee; and an ERM function under the chief risk officer, who reports to the board risk committee, with an operational risk team of six and the model risk function of four. In one year the account reconciliation control over the general ledger suspense accounts was tested by the SOX program (as a key control), by compliance (as part of a regulatory reporting review) and by internal audit (in the financial close audit), with three sets of requests to the same reconciliation team and three slightly different conclusions. The controller complained to the audit committee chair, who asked the four heads to write down who does what.
| Agreement element | What the four heads agreed | Effect in the first year |
|---|---|---|
| Shared vocabulary | ERM’s taxonomy adopted by all four for classifying risks and findings; one five-point rating scale; one finding severity scale (internal audit’s, adopted by compliance and the SOX office) | Board packs comparable for the first time; the combined assurance report possible |
| Assurance map | Built jointly: 126 audit universe entities against the four functions’ coverage, with testing dates; white space and overlaps marked | Three overlaps removed (suspense reconciliations, wire callbacks, vendor onboarding); two white spaces found (incentive compensation, data governance) and assigned |
| Reliance protocol | Internal audit assesses SOX and compliance testing quality annually; where rated reliable, internal audit scopes around it and says so in its plan; where not, it tests itself and reports why | Internal audit redirected about 900 hours from re-testing ICFR controls to the digital channels and third-party entities |
| One issue system | All findings from the four functions and regulators in one system, source-tagged, one closure evidence standard; internal audit validates High findings from any source | Issue count to the board reconciled; duplicate issues merged (31 of 410) |
| Policy register | One owner per policy; internal audit removed as owner of two operational policies it had drafted years earlier; appetite owned by ERM | Two policies reassigned; internal audit’s independence over them restored |
| Request coordination | A shared quarterly calendar of testing and document requests; one request to a control owner per control per quarter where possible | Control owner survey: time spent on assurance requests down about a third |
| Board reporting | A combined assurance page in the audit committee pack: ERM profile against appetite, SOX status, compliance exposure, internal audit’s view, in the shared vocabulary | Committee chair: “the first pack I could read in one sitting” |
| Governance of the agreement | Quarterly meeting of the four heads; annual review; disputes to the audit committee chair | Two disputes in the year (who tests model inventory completeness; who owns the hotline statistics), both settled in the meeting |
The agreement did not change any function’s mandate, reporting line or independence; it changed how the four used one another’s work, and the banking guide‘s account of the supervisory year records the examiners’ comment that the bank’s assurance functions appeared to operate as a system. The chief audit executive’s note was that the triple-tested reconciliation had been a gift: without it the four would have continued to prove their worth separately, to the same control owners, for years.
Questions about the four functions
What is the difference between internal audit and compliance?
Compliance is a second-line management function that ensures the organization meets its obligations: it owns policies, advises, monitors and tests to manage compliance risk. Internal audit is the independent third line that assures the board that compliance, and everything else, is managed; it audits the compliance function itself.
Is SOX part of internal audit?
No. The SOX program is management’s own assessment of internal control over financial reporting, usually run from finance, which the external auditor attests. Some organizations have internal audit perform the testing as a service to management, which impairs the function’s independence over financial reporting controls unless managed and disclosed.
What does enterprise risk management do that the others do not?
It maintains the framework (taxonomy, appetite, register, RCSA, KRIs) that the others use and produces the aggregated enterprise view of risk against appetite for the board, which no function focused on financial reporting, compliance or audit coverage can produce because none sees the whole.
Which of the four is independent?
Only internal audit, which reports functionally to the board’s audit committee and has no management responsibilities. Compliance and ERM are independent of the business lines they oversee but are part of management; the SOX program is management’s self-assessment.
Why do all four test controls?
They test for different purposes: SOX to support management’s certification, compliance to manage regulatory risk, internal audit to assure the board. ERM usually does not test. The duplication is avoidable through an assurance map and a reliance protocol under which internal audit scopes around testing it has assessed as reliable.
Can one person do all four in a small company?
One person can perform risk facilitation, compliance coordination and control testing as management roles, but cannot also provide independent assurance over them. Small companies either accept that gap with disclosure, co-source the assurance, or keep internal audit separate and let the other roles sit with management.
How should the four report to the board?
In one vocabulary, ideally on one combined assurance page: ERM’s profile against appetite, SOX’s status, compliance’s exposure and internal audit’s independent view, so that the committee can compare rather than translate.
Related guides
- The Three Lines Model explained — the placement framework.
- Internal audit vs compliance — the pair most often confused.
- What are internal controls, who tests them — the control side of the map.
- Is internal audit accounting? — another common confusion.
- Internal audit vs external audit — the outside assurance provider.
- GIAS Domain I — internal audit’s purpose.
- Independence and objectivity — what makes the third line different.
- Assurance vs advisory — internal audit’s two modes.
- SOX 404 and SOX 302 vs 404 vs 906 — the SOX program’s law.
- SOX for control owners — the first line’s part.
- How to run a compliance risk assessment — compliance’s foundation.
- Auditing the ERM program — internal audit assuring the second line.
- Assurance mapping: a worked example — the document that settles the overlaps.
- Risk taxonomy — the shared vocabulary.
- Tracking internal audit issues — one issue system.
- Building a GRC framework — the integrated view.
- Internal audit in banking — the four functions at scale.
- Pre-IPO SOX readiness — when SOX arrives.
- Standing Up Internal Audit After an IPO: The First 18 Months — the first 18 months: charter, plan, staffing, SOX and the committee.
Leave a Reply