A one-person internal audit shop is a function in which the chief audit executive is also the entire staff: the planner, the fieldworker, the reviewer, the report writer, the quality program, the committee secretary and the person who answers when the CEO asks “can you look into this.” It is far more common than the profession’s literature suggests; the IIA’s global surveys have for years shown that a large share of functions worldwide have five or fewer staff, and a meaningful fraction have one. The Global Internal Audit Standards apply to that person in full, with the proportionality the Standards allow and without the exemptions the solo auditor sometimes hopes for, and the difficulty is not knowing what the Standards require but doing it with no one else in the room.
This manual is written for that person. It covers the mandate and the board relationship as the function’s lifeline, proportionate risk assessment and planning done alone, the engagement method a solo auditor can sustain, the quality program when there is no reviewer (self-review disciplines, peer exchange, and the external assessment route the Standards allow for small functions), sourcing specialist skills per engagement without losing control, independence when management sees one convenient person, the Standards requirements that do not shrink with size and the ones that do, a year in the life of the function, the failure modes that end solo shops, and a worked example of Brightwater Foods’ first chief audit executive’s year alone before a second auditor was funded. It draws on the small company function and first 90 days guides and on the methodology manual, which a solo function needs more than a large one.
In this guide
- What does not shrink with size, and what does
- The mandate and the board relationship as lifeline
- Proportionate risk assessment and planning, alone
- An engagement method one person can sustain
- The quality program with no reviewer
- Buying specialist skills per engagement
- Independence when management sees one convenient person
- Tools, templates and time
- Template: the solo function’s resource sufficiency statement
- A year in the life
- Failure modes that end solo shops
- Making the case for the second person
- Worked example: Brightwater Foods’ chief audit executive’s year alone
- Questions about one-person audit functions
- Related guides
What does not shrink with size, and what does
| Requirement | For a one-person function | Standard |
|---|---|---|
| Charter, mandate and board approval | Required in full; the charter is the solo auditor’s only protection | 6.1, 6.2 |
| Functional reporting to the board; CAE appointment and evaluation by the board | Required in full; the solo CAE’s independence rests on it | 7.1 |
| Risk-based plan approved by the board; resource sufficiency statement | Required; proportionate in depth; the sufficiency statement is where the second person is asked for | 9.4, 8.2 |
| Methodology | Required; shorter, but written down, because the solo auditor’s memory is the function’s only methodology otherwise | 9.3 |
| Engagement planning, risk assessment, work program, documentation | Required in full for every engagement; proportionate in length | 13.x, 14.6 |
| Supervision and review of engagements | Required; achieved by structured self-review, peer exchange or co-source review, documented | 12.3 |
| Quality assurance and improvement program with internal and external assessments | Required; the external assessment may be a self-assessment with independent external validation | 8.3, 8.4, 12.1, 12.2 |
| Conformance statement and disclosure of nonconformance | Required; a solo function that cannot conform in an area says so to the board | 12.1, 15.1 |
| Competency across the universe | Required; met by co-sourcing where the solo auditor lacks the skill, and declined where it cannot be bought | Principle 4; 10.2 |
| Communication of risk acceptance; escalation | Required; the solo CAE escalates alone | 11.5 |
What shrinks is depth and breadth, not kind: fewer engagements, shorter documents, a universe at coarser granularity, a methodology of twenty pages rather than two hundred. The Standards’ own text allows proportionality, and the external assessors who later judge the function expect it; what they do not accept is the absence of a requirement because the function was small, which is why the table’s first column matters more to a solo auditor than to anyone else.
The mandate and the board relationship as lifeline
A solo auditor has no colleagues, no manager and no professional practices team; the audit committee chair is the only person in the organization whose job includes protecting the function, and the relationship with the chair is therefore the function’s lifeline rather than one stakeholder relationship among many. Three practices build it. A charter approved by the board that states the CAE’s functional reporting to the committee, unrestricted scope and access, the committee’s approval of the plan and budget, and the committee’s role in the CAE’s appointment, evaluation and remuneration (the charter guide and the committee charter guide have the clauses); a standing private session with the chair at every committee meeting and a call between meetings, in which the solo auditor says what cannot go in a pack; and a resource sufficiency statement every year that says plainly what the function can and cannot cover alone, so that the board’s acceptance of the gap is the board’s decision and on the record. The CAE guide describes the relationship for functions of any size; for the solo auditor it is also the answer to the question “who do I call when the CFO tells me to drop a finding.”
Proportionate risk assessment and planning, alone
| Element | Proportionate version | What must still be true |
|---|---|---|
| Audit universe | 30 to 60 entities at process or unit level, reconciled to the organization chart and product list once a year | Complete; every entity rated; documented (the universe guide) |
| Risk assessment | Three to five factors with written anchors; one afternoon with the CFO and the COO to challenge the ratings | Ratings explained; the method consistent year to year |
| Capacity | About 1,000 to 1,200 productive hours after administration, committee work, training and the CEO’s requests | Honest: a plan of 1,800 hours for one person is a plan to fail |
| Plan | Four to seven engagements of 120 to 250 hours, plus a reserve of 15 to 20 percent for requests and investigations | Approved by the committee with the coverage it does not provide stated |
| Cycle | High-risk entities every one to two years; the rest when the plan allows; the committee told what is beyond reach | The gap is the board’s accepted risk, not the auditor’s secret |
| Use of others’ assurance | A simple assurance map of who else covers what (external auditor, certifications, second-line functions where they exist) | Reliance assessed, not assumed |
The solo auditor’s planning error is ambition: a universe of 120 entities and a plan of twelve engagements, because that is what the textbook function does. The year-one plan guide argues for fewer, better engagements in a new function, and the argument holds for a solo function in every year. Five engagements completed with full documentation and validated actions do more for the organization and the function’s standing than ten half-finished, and a committee that has watched a solo auditor finish what was promised will fund the sixth engagement faster than one that has watched twelve begin.
An engagement method one person can sustain
Every engagement follows the same sequence, from templates, so that the solo auditor’s attention goes to the subject and not to the format: a two-page planning memo with the engagement-level risk assessment and the work program in one document; a walkthrough; fieldwork with a standard workpaper layout and tick marks; findings in the five Cs; a closing meeting; a short report from the template; and actions tracked in one issue log. Three adaptations suit the solo auditor. Analytics first: a query over the whole population costs less than a sample and leaves evidence that reviews itself, so the solo auditor’s SQL or spreadsheet skills (the SQL guide) are the highest-return investment in the function. Engagements sized to be finished: 120 to 250 hours, three to six weeks of elapsed time, because a solo engagement that runs for a quarter is interrupted by everything else. And reporting in the open: draft findings shared with the owner as they are confirmed, so that the closing meeting holds no surprises and the report’s facts have been checked by the only other people who know them.
The quality program with no reviewer
| Element | How a solo function does it | Evidence |
|---|---|---|
| Engagement review (12.3) | Structured self-review with a checklist, performed at least a day after completing the work and before issuing, covering the risk assessment, program completion, evidence sufficiency, finding support and report accuracy; the checklist signed and filed | Completed checklists in every file |
| Peer exchange | A reciprocal arrangement with one or two solo or small-function CAEs in other organizations (through the IIA chapter or a professional network) to review each other’s files under confidentiality, two or three a year | Peer review notes; the agreement |
| Co-source review | Where a co-source firm works on an engagement, its reviewer reviews the solo auditor’s work on it too, by contract | Reviewer sign-offs |
| Ongoing monitoring (12.2) | A quarterly self-assessment against a short conformance checklist; metrics (plan completion, report cycle time, action closure) reported to the committee | The self-assessment template; the metrics page |
| Periodic self-assessment (12.1) | Annual, against all 52 standards, with gaps and actions | The QAIP playbook‘s self-assessment |
| External assessment (8.4) | At least every five years; the Standards permit a self-assessment with independent external validation, which costs a fraction of a full assessment and suits a solo function; the validator must be qualified and independent | The validation report to the committee |
| Conformance statement | Annual to the committee; nonconformance disclosed where it exists (commonly 12.3 review and competency gaps) | The statement in the annual report |
| Development | CPE and skills plan tied to the universe; the reading program for one | Training records |
The honest position on 12.3 is that a solo auditor cannot be independently supervised on every engagement, and the quality program should say so and show what substitutes for it. External assessors accept a documented self-review discipline plus peer or co-source review on a sample as a proportionate response; they do not accept the absence of any review because the function is one person. The external assessment guide covers the self-assessment-with-validation route in detail.
Buying specialist skills per engagement
No one person can audit IT general controls, cyber, treasury, tax, actuarial models and construction contracts to a professional standard, and the Standards’ competency principle is met by buying the skill rather than pretending to it. The solo auditor’s co-sourcing rules: a framework agreement with one or two firms, selected on the RFP method, with rates and a named team, so that each engagement does not start with procurement and the firm’s people learn the business across years rather than re-learning it each time; the solo auditor plans and scopes every co-sourced engagement, attends the opening and closing meetings, reviews the workpapers and signs the report, so that the work is the function’s and not the firm’s (the co-sourcing guide describes the model); the firm’s reviewer reviews the solo auditor’s own work on the engagement in return; and the budget for co-source is in the plan the committee approves, typically a third to a half of the function’s total cost for a solo shop with a technology-heavy universe. The sourcing options guide compares the models; the rule the solo auditor cannot break is that co-sourcing buys skill, never independence: a firm that also advises management on the area cannot audit it for the function.
Independence when management sees one convenient person
| Request | Why it comes to the solo auditor | Response |
|---|---|---|
| “Can you run the SOX testing?” | Nobody else knows controls | As a management service labeled as such, with the committee’s knowledge, and never as assurance over the same controls; or decline and help management hire |
| “Can you facilitate the risk workshops?” | Nobody else knows risk | Yes, as advisory with the safeguards in the ERM audit guide; the register is management’s; the function discloses the role |
| “Can you write the policies?” | Nobody else writes | Advise on structure and content; management drafts and owns; the function does not own operational policy |
| “Can you investigate this?” | The hotline came to you | Yes, within the protocol agreed with counsel, with the committee chair informed; investigations are reserve hours in the plan |
| “Can you approve this while the controller is out?” | You are a senior person with a desk | No; performing a control ends the function’s ability to audit it |
| “Can you report to the CFO instead? It would be simpler.” | Administrative convenience | Administrative reporting to the CEO or CFO is permitted; functional reporting to the committee is not negotiable, and the chair should hear of the request |
| “Can you leave that finding out? The board will overreact.” | You are alone | The finding stays; the negotiating findings guide covers the conversation; the chair is the escalation route |
Tools, templates and time
A solo function runs on templates and a small toolset: the methodology manual at twenty pages, with the planning memo, workpaper, finding, report and issue log templates attached; a spreadsheet or a lightweight audit management tool for the universe, plan, hours and issues (the small-team software guide weighs the options, and the free tools guide the no-budget ones); a query tool for analytics; and a calendar with the committee cycle fixed a year ahead. Time is the scarce resource and the budget is honest about it: of 2,000 hours a year, about 300 go to the committee, planning, quality and administration, 150 to training and professional activity, 100 to the CEO’s and chair’s requests, and 200 to the reserve for investigations and the unexpected, leaving 1,200 or so for engagements, of which co-source may deliver a share. The KPI guide’s small-function set (plan completion, cycle time, action closure, committee satisfaction) is the solo auditor’s dashboard, kept to one page.
Template: the solo function’s resource sufficiency statement
Resource sufficiency statement, [year]. The internal audit function consists of one person, the chief audit executive, supported by a co-source arrangement with [firm] for [technology and specialist] work. Available capacity for the year is [1,150] productive hours in-house and [400] co-sourced hours within the approved budget of [$]. The approved plan uses that capacity for [five] engagements covering [entities], all of the universe’s [eleven] high-risk entities except [two: technology general controls and the sales process], which cannot be covered this year within the resources available. The risk of leaving them uncovered is [stated in the risk assessment’s terms]; the committee is asked to accept that coverage gap for the year or to fund [co-source hours or a second position] to close it. The function’s quality program discloses nonconformance with Standard 12.3 on engagement supervision, mitigated by [self-review, peer review and co-source review]; a second in-house auditor would close that nonconformance and add approximately [1,100] productive hours. The chief audit executive confirms that, within the stated gaps, the function has the resources to deliver the approved plan and to conform with the Standards. [Signature, date; committee acknowledgment and decision recorded in the minutes.]
The statement is one page and it is the solo function’s most consequential document after the charter, because it converts the auditor’s private worry about coverage into the board’s recorded decision, and because it is where the second person is asked for every year until the answer is yes. Standard 8.2 requires it of every function; for one person it is also self-defense, since a committee that accepted the gap in writing cannot later ask why the uncovered entity produced a loss.
A year in the life
| Quarter | Engagements | Function work | Committee |
|---|---|---|---|
| First | Engagement 1 (120 to 200 hours); validation of prior-year actions | Annual report and conformance statement; quality self-assessment results | Annual report; private session |
| Second | Engagement 2; co-sourced technology engagement scoped and launched | Peer review exchange (one file each way); CPE | Results; co-source plan |
| Third | Engagement 3; co-sourced engagement reviewed and reported | Universe refresh; risk assessment with the CFO and COO; draft plan and capacity | Mid-year plan update; risk assessment preview |
| Fourth | Engagement 4 (or two short ones); reserve used for a request | Plan, budget, resource sufficiency statement; methodology review; next year’s calendar | Plan approval; CAE evaluation by the chair; charter review |
Four to five engagements a year, one of them co-sourced, with every action validated and every committee meeting prepared, is a full year for one person, and the calendar above leaves no quarter without a committee deliverable, which is deliberate: the committee’s sense that the function is working comes from what it receives. The audit committee calendar‘s private-company variant gives the committee side of the same year.
Failure modes that end solo shops
| Failure | How it happens | Prevention |
|---|---|---|
| Absorbed by management | The solo auditor becomes the SOX tester, the risk manager and the policy writer; the committee stops receiving assurance and does not notice | Role labels; disclosure; the chair relationship; the resource statement that names the roles |
| Over-planned | Twelve engagements planned, five finished, none validated; the committee concludes the function cannot deliver | Honest capacity; fewer engagements; reserve |
| Undocumented | Files are notes in the auditor’s head; the auditor leaves; nothing remains | Templates; the methodology manual; the issue log |
| Unreviewed | Errors in reports erode credibility; a finding is wrong and management says so publicly | Self-review discipline; peer exchange; facts checked with owners before issue |
| Isolated | No professional contact; methods drift; the auditor burns out | Chapter membership; peer network; CPE; the chair relationship |
| Competency overreach | The solo auditor audits cyber alone and misses what a specialist would see | Co-source for the skills the universe needs; decline what cannot be bought and say so |
| Lost in a dispute | A finding escalates; the auditor has no backer | The charter’s escalation clause; the chair informed early; the risk acceptance process |
| Succession void | The auditor leaves; the function closes for a year | Documentation; a co-source firm that could bridge; the committee’s awareness |
Making the case for the second person
Most solo shops should become two-person shops, and the case is made with three facts the function’s own operation produces: the coverage gap (the universe’s high-risk entities beyond the plan’s reach, with their risk ratings, from the resource sufficiency statement); the cost of the alternative (the co-source hours bought each year at a multiple of an employee’s rate); and the review gap (the 12.3 nonconformance the quality program disclosed). A second auditor who performs fieldwork while the CAE reviews, and whose work the CAE can supervise as the Standards intend, closes the review gap, roughly doubles productive hours, lets the function run two engagements in parallel and gives it a successor, which is the argument that lands with a committee that has just read a conformance statement with a disclosure in it. The Brightwater example below is the case made from a day-90 report; the inside the department guide describes what a function of two to six looks like once it exists.
Worked example: Brightwater Foods’ chief audit executive’s year alone
Brightwater Foods is a $180 million food manufacturer with three plants and about 600 staff, used in examples across this site. Its board formed an audit committee and hired a first-time chief audit executive, a senior manager from a larger manufacturer, who negotiated functional reporting to the chair before accepting and arrived to find a co-sourced internal audit arrangement sponsored by the finance director, no charter, no universe and no plan. The first 90 days guide recounts the listening tour, the health check that rated eight of ten areas absent and the eleven-page day-90 report that won the charter and the funding for a second in-house auditor. This section covers the year between: the CAE alone, with the co-source firm rerouted to report to the function, building a solo shop that could pass an external assessment before the second auditor arrived.
| Element | What the CAE did alone | Result |
|---|---|---|
| Mandate | Charter approved at day 90 with functional reporting, unrestricted access and the committee’s approval of plan, budget and the CAE’s evaluation; private session with the chair at every meeting and a monthly call | Two attempts to redirect the function (a request to own SOX-style control testing for the lenders; a request to drop a finding on the immutable backup) resolved through the chair |
| Universe and plan | Universe of 61 entities built in six weeks and reconciled to the org chart and product list; three-factor risk assessment challenged by the COO and finance director; plan of five engagements (cyber resilience and third-party resilience co-sourced; procure-to-pay analytics, planned maintenance and the BCM program in-house) against 1,150 productive hours plus 400 co-source hours; reserve 180 hours | Five of five completed; the resilience findings funded; the committee told that technology general controls and the sales process were beyond reach that year and accepted it on the record |
| Method | Twenty-page methodology manual with templates in month four; analytics-first on procure-to-pay (full population); engagements sized at 150 to 250 hours | Reports issued within three weeks of fieldwork; every finding fact-checked with the owner before the closing meeting |
| Quality | Self-review checklist on every file; peer exchange with a solo CAE at a regional distributor (two files each way); co-source reviewer reviewed the CAE’s work on the two joint engagements; quarterly conformance self-check; annual self-assessment disclosing nonconformance with 12.3 and a competency gap in technology | The first annual report to the committee carried a conformance statement with two disclosures and a plan to close one by hiring |
| Sourcing | Framework agreement with the existing firm renegotiated: the function scopes, reviews and signs; the firm’s reviewer reviews the CAE; the firm barred from advising management on areas it audits | Co-source cost down 20 percent; the firm’s cyber specialists delivered the resilience review the CAE could not |
| Independence | Declined to own control testing for the lenders; facilitated the taxonomy and risk register work as disclosed advisory, with management owning the outputs; declined to approve payments during the controller’s leave | The committee saw each decision in the private session; none became a dispute |
| Case for growth | Resource sufficiency statement with the coverage gap (technology general controls, sales, HR), the co-source cost and the 12.3 disclosure | Second in-house auditor funded from the day-90 report and confirmed at the year-end plan approval; started in month fourteen |
The year’s lesson, recorded in the CAE’s note to the committee, was that the function’s survival alone depended on three documents and one relationship: the charter, the methodology manual and the resource sufficiency statement, and the chair. Everything else was work, and work can be done by one person for a year if those four things hold; the second auditor’s arrival in month fourteen was the proof that the committee had read the statement and believed the year behind it.
Questions about one-person audit functions
Do the Global Internal Audit Standards apply to a one-person function?
Yes, in full, with proportionality in depth and documentation. Every requirement applies; what shrinks is the length of the methodology, the granularity of the universe and the number of engagements. Where the function cannot conform (commonly on engagement supervision), it discloses the nonconformance to the board.
How does a solo auditor meet the engagement review requirement?
By a documented self-review discipline (a checklist completed after a delay and before issue), reciprocal peer review with another small-function CAE on a sample of files, and co-source reviewer involvement on joint engagements, with the residual nonconformance disclosed. Assessors accept the substitute; they do not accept no review.
Does a one-person function need an external quality assessment?
Yes, at least every five years. The Standards allow a self-assessment with independent external validation, which a qualified independent validator can perform at a fraction of a full assessment’s cost and which suits a solo function.
How many audits can one person do in a year?
Four to seven engagements of 120 to 250 hours against about 1,000 to 1,200 productive hours after committee work, planning, quality, training and requests, with one or two co-sourced. More than that is usually a plan that will not be finished.
Can the solo auditor also run SOX testing or risk management?
Only as labeled management services with the committee’s knowledge, and never as assurance over the same areas. Facilitating risk work is permitted as disclosed advisory with safeguards; performing controls or owning policies is not, because it ends the function’s ability to audit them.
What is the most important relationship for a solo auditor?
The audit committee chair, through functional reporting written into the charter, a private session at every meeting and contact between meetings. The chair is the only person whose role includes protecting the function, and the escalation route when management pushes.
How do I make the case for a second auditor?
With the function’s own evidence: the coverage gap in the resource sufficiency statement, the co-source cost paid at a multiple of an employee’s rate, and the engagement review nonconformance disclosed in the conformance statement, which a second person closes.
Related guides
- How to establish an internal audit function in a small company — the founding steps.
- Your first 90 days as chief audit executive — Brightwater’s day-90 report.
- The year-one audit plan — fewer, better engagements.
- The internal audit methodology manual — the twenty-page version.
- How to create an internal audit charter — the solo auditor’s protection.
- The audit committee charter — the committee’s side of the relationship.
- What is a chief audit executive — the role when it is the whole function.
- QAIP playbook and QAIP self-assessment template — the quality program.
- Preparing for an external quality assessment — the self-assessment-with-validation route.
- Internal audit co-sourcing 101 and sourcing options — buying skills.
- How to select an internal audit consulting firm — the framework agreement.
- Assurance mapping — who else covers what.
- Engagement-level risk assessment — planning each engagement alone.
- SQL for auditors — the solo auditor’s highest-return skill.
- Audit software for small teams and free internal audit software — the toolset.
- Internal audit KPIs — the one-page dashboard.
- Risk acceptance by management — the escalation process.
- Inside the internal audit department — what the function becomes at two to six.
- Standing Up Internal Audit After an IPO: The First 18 Months — the first 18 months: charter, plan, staffing, SOX and the committee.
- Continuous Monitoring on a Small Budget: 5 to 10 Indicators — five to ten indicators, Power Query or SQL jobs, thresholds and triage, with no platform.
- Your First Audit Committee Meeting as CAE: How to Prepare — pre-meeting one-on-ones, the content arc, candor on inherited problems and the rituals to propose.
Leave a Reply