Internal audits come in kinds, and the kind decides almost everything about the engagement: what the auditor measures the subject against (the criteria), how the work is done (procedures and evidence), what the report says (a conclusion on controls, an assessment of compliance, a judgment on efficiency, a set of recommendations, a finding of fact) and who reads it. The names are not standardized, every function labels its work slightly differently, and the same engagement can carry two labels at once; but fifteen types recur across functions, sectors and countries, and an auditor, a manager being audited or a new audit committee member who knows them can read any plan and understand what is coming.
This guide explains the fifteen. For each it gives the purpose, the criteria it uses, the typical procedures, the output and an engagement on this site that shows it worked through. It then compares them in a single table, maps them to the Global Internal Audit Standards’ distinction between assurance and advisory services, explains how a function decides which type an engagement should be when planning it, shows the mix a typical plan contains with MidState Beverage’s eight FY27 engagements classified, describes how the types combine in practice, and answers the questions new auditors and auditees ask. It is a front door: the what internal audit means and step-by-step guides cover the process any type follows, and the fieldwork guide the work itself.
In this guide
- Why the type matters
- The core types: operational, financial, compliance, IT
- Integrated and performance audits
- Advisory engagements
- Investigative and forensic engagements
- Follow-up, validation and continuous auditing
- Thematic, project, third-party, quality and ESG audits
- Names that vary by sector and country
- The fifteen compared
- Assurance or advisory: how the Standards divide them
- Choosing the type in planning
- The mix in a plan: MidState Beverage’s eight engagements
- How types combine in practice
- What each type means for the people being audited
- Questions about types of internal audit
- Related guides
Why the type matters
Two engagements on the same process can be different audits. A financial audit of accounts payable tests whether payables are complete, accurate and properly recorded; an operational audit of the same process asks whether invoices are paid efficiently and discounts captured; a compliance audit asks whether tax and sanctions rules are followed; an IT audit asks whether the system enforces the three-way match; an investigative engagement asks who paid the fictitious vendor. Each uses different criteria (accounting standards, efficiency benchmarks, laws, configuration standards, facts), different procedures and different sample logic, produces a different report, and is read by a different audience. Naming the type at the planning stage is how the team avoids the common failure of an engagement that tests controls, measures efficiency and investigates an allegation in the same 300 hours and does none of them well; the planning memo states the type and the criteria that follow from it.
The core types: operational, financial, compliance, IT
| Type | Purpose | Criteria | Typical procedures | Output | Worked example on this site |
|---|---|---|---|---|---|
| Operational audit | Whether a process or unit achieves its objectives effectively and efficiently, with adequate controls over its operational risks | Management’s objectives, policies and procedures; good practice; agreed criteria where none exist | Walkthroughs, control testing, analytics, observation, interviews; comparison of practice with design and with peers | Findings on control weaknesses and inefficiencies; an overall rating of the area | Planned maintenance at Brightwater; inventory |
| Financial audit (internal) | Whether financial records and reports are complete, accurate and supported, and whether the controls over financial reporting operate | Accounting standards; the organization’s accounting policies; SOX or FDICIA control requirements | Reconciliation testing, journal entry testing, substantive sampling of balances, control testing of the close | Findings on misstatement risk and control deficiencies; input to the SOX assessment | Financial close; journal entries; reconciliations |
| Compliance audit | Whether the organization meets specific laws, regulations, contracts or internal policies | The law, regulation or contract itself; regulator guidance; the organization’s policies | Testing transactions and records against the requirement; file reviews; checklist-based testing; regulatory report re-performance | Findings of non-compliance with the requirement cited; a conclusion on the program | BSA/AML independent testing; data privacy; ISO 14001 |
| IT and cybersecurity audit | Whether systems, infrastructure and data are controlled: access, change, operations, security, availability, data integrity | Frameworks (COBIT, NIST CSF, ISO 27001), the organization’s IT policies, vendor configuration standards, regulatory IT requirements | Configuration review, access and change testing, vulnerability evidence, log review, automated control testing, technical re-performance | Findings on general and application controls; maturity assessments against a framework | ITGC primer; IT audit plan; cybersecurity program |
These four cover most of a typical plan, and the older overview of audit types on this site listed them in brief. The lines between them blur at the edges: an accounts payable audit is financial in its payables testing, operational in its efficiency questions and compliance in its tax and sanctions checks, which is why integrated audits exist.
Integrated and performance audits
| Type | Purpose | Criteria | Typical procedures | Output | Worked example |
|---|---|---|---|---|---|
| Integrated audit | Covers a process end to end across its financial, operational, compliance and technology dimensions in one engagement, with business and IT auditors on one team | All of the above, chosen per risk in the engagement risk assessment | A single work program spanning process controls and the application and general controls they depend on | One report on the process with findings across the dimensions | Procure to pay; order to cash; accounts payable with its ITGC dependencies |
| Performance (value-for-money) audit | Whether a program or activity achieves its intended results economically, efficiently and effectively; the public sector’s primary type and increasingly used in the private sector for programs and functions | Program objectives and targets; benchmarks; cost standards; outcome measures; the Yellow Book’s performance audit standards in US government work | Outcome measurement, cost analysis, benchmarking, process mapping, stakeholder interviews, data analysis | Conclusions on economy, efficiency and effectiveness with recommendations; often a published report in the public sector | The KPI guide shows the measures; the public-sector guides on this site are forthcoming |
Advisory engagements
Advisory (consulting) engagements are the Standards’ second category of service: work the function performs at management’s request to provide advice, facilitation, training or assessment without an assurance conclusion, with the nature and scope agreed with the client and with safeguards so that the function does not later audit what it designed. Common forms are control design advice on a new process or system, facilitation of a risk assessment or a mapping exercise, pre-implementation reviews that advise rather than conclude, readiness assessments before a regulation takes effect (the DORA and pre-IPO SOX guides describe two), benchmarking, and training for control owners. The output is advice, not an opinion; the report says so; and the function records the engagement as advisory so that the independence consequences are visible, which the assurance versus advisory guide treats in detail and the ERM audit guide shows going wrong when the distinction is lost. A plan typically holds 10 to 20 percent advisory hours; more than that and the function is becoming a consulting arm of management.
Investigative and forensic engagements
An investigation establishes facts about a specific allegation or event (a suspected theft, a conflict of interest, a hotline report), and it is a different discipline from an audit: the criteria are facts and law rather than controls and standards, the procedures include evidence preservation, forensic data analysis, interviews conducted under rules that protect their later use, and coordination with counsel and human resources, and the output is a report of findings of fact, often privileged, rather than a control conclusion. Internal audit performs investigations in many organizations and supports them in others, always under a protocol agreed with the general counsel that decides who leads, who is told and when, and the first 48 hours guide describes the start. Forensic audits are the proactive cousin: engagements designed to detect fraud in a population through analytics and targeted testing (the procurement fraud analytics run is one), which may lead to an investigation but are planned as audits. The two should be labeled distinctly in the plan because they consume reserve hours unpredictably and because an investigation’s findings are handled under different rules from an audit’s.
Follow-up, validation and continuous auditing
| Type | Purpose | Criteria | Typical procedures | Output | Worked example |
|---|---|---|---|---|---|
| Follow-up and issue validation | Whether management’s agreed actions on prior findings have been implemented and are effective, so that issues can be closed on evidence rather than assertion | The original finding and the agreed action; the control’s design | Design and operating tests of the remediated control; evidence review; re-performance over a period | Validation memo per issue: closed, partially closed or not closed, with evidence; reporting to the committee | Issue validation; validation workpapers; regulatory findings |
| Continuous auditing | Automated, frequent testing of transactions or controls across whole populations, producing exceptions for investigation on a schedule rather than a periodic engagement | The control’s rule, encoded; thresholds; the data | Scripts and queries run daily, weekly or monthly; exception triage; trend analysis | Exception reports and periodic summaries; findings when patterns emerge | Continuous auditing guide; CA versus continuous monitoring; the query library |
Follow-up is the type most often underfunded and the one that produces the most value per hour, because an unvalidated finding is a report and a validated one is a changed control; the life of a finding guide explains the economics. Continuous auditing is a method as much as a type, and functions that build it treat it as a standing entity in the universe with its own hours, as the bank universe shows.
Thematic, project, third-party, quality and ESG audits
| Type | Purpose | Criteria | Typical procedures | Output | Worked example |
|---|---|---|---|---|---|
| Thematic (horizontal) audit | Examines one risk or control theme across many units or processes (segregation of duties everywhere; vendor master controls across all subsidiaries; the same control at twelve depots) | The theme’s policy or standard applied consistently | The same test performed across the units; comparison; root cause analysis of variation | A cross-organizational finding with the pattern and the outliers; often more useful to a board than unit-by-unit reports | ERP segregation of duties; MidState’s depot rotation |
| Project and pre-implementation audit | Assurance over a major change (a system implementation, a construction program, an acquisition integration) while it is under way, so that findings can change the outcome | Project governance standards; the business case; the design specifications; contract terms | Governance review, milestone and budget testing, design review for controls, data migration testing, go-live readiness assessment | Findings at stage gates; a readiness opinion before go-live | SDLC and pipeline; change management; capital projects (roadmap) |
| Third-party and vendor audit | Assurance over the organization’s management of suppliers and outsourced services, and sometimes over the supplier itself under contractual audit rights | The third-party program’s policy; contract terms; regulatory third-party requirements; SOC report criteria | Program testing (inventory, due diligence, monitoring); contract compliance testing; SOC report review; site visits under audit clauses | Program findings; contract compliance findings; recoveries from overbilling | TPRM program; due diligence by tier; SOC 1 review |
| Quality and management-system audit | Whether a certified management system (ISO 9001 quality, ISO 14001 environmental, ISO 27001 security, food safety schemes) conforms to the standard and the organization’s own documentation; often performed by a quality function and relied on by internal audit | The ISO or scheme standard; the organization’s manual and procedures | Clause-by-clause conformance checks; process observation; records sampling; nonconformance classification | Nonconformances (major, minor) and observations; input to certification | ISO 9001 internal audits; ISO 14001 |
| ESG and sustainability audit | Assurance over environmental, social and governance data, controls and disclosures, and over the programs behind them | Reporting frameworks and standards; regulatory disclosure rules; the organization’s commitments | Data lineage and controls testing for reported metrics; program assessment; disclosure review against the framework | Findings on data reliability and program effectiveness; readiness for external assurance | ESG auditing; environmental and climate risk |
Names that vary by sector and country
The same work carries different names in different places, and a reader moving between sectors or reading a job description from another country should translate rather than assume a new type has appeared. Government auditors in the United States work under the Yellow Book, which divides engagements into financial audits, attestation engagements, reviews of financial statements and performance audits, and “performance audit” there covers much of what a corporate function would call operational, compliance and IT work. The United Kingdom’s public-sector auditors call the same thing value-for-money audit. Banks label a compliance audit of a regulatory program a “regulatory audit” or “independent testing” (the BSA/AML term), and a validation engagement over a regulator’s finding “MRA validation” or “issue closure testing”. Functions that support management’s Sarbanes-Oxley assessment call that work “SOX testing” or “404 support” and, if they are careful, label it a management service rather than an audit, as the SOX 404 guide and the four functions guide explain. Project assurance appears as “pre-implementation review” before go-live and “post-implementation review” six to twelve months after it, the latter asking whether the business case was delivered. Facilitated control self-assessment, in which the function helps a unit rate its own controls in a workshop, is an advisory engagement under most methodologies even where it is called an audit. And “assurance review”, “health check” and “deep dive” are usually operational audits with a lighter or narrower scope, which the planning memo should say plainly so that the committee does not read a two-week health check as a full audit opinion.
| Name you may see | Where | What it is in this guide’s terms |
|---|---|---|
| Performance audit (Yellow Book) | US government | Performance; often also operational, compliance and IT |
| Value-for-money audit | UK and Commonwealth public sector | Performance |
| Regulatory audit; independent testing | Banking and insurance | Compliance |
| MRA validation; issue closure testing | Regulated banks | Follow-up and validation |
| SOX testing; 404 support; ICFR testing | Listed companies and FDICIA banks | Financial, labeled as management support |
| Pre- and post-implementation review | Any sector with system or capital programs | Project audit, before and after go-live |
| Control self-assessment facilitation | Any | Advisory |
| Health check; deep dive; assurance review | Any | Operational audit of narrower or lighter scope; state the scope |
| Due diligence review | Acquisitions; third parties | Advisory before a deal; third-party program testing after |
| Internal quality audit | Manufacturing, food, labs, healthcare | Quality and management-system audit |
The fifteen compared
| Type | Service | Main criteria | Main evidence | Main reader | Share of a typical plan |
|---|---|---|---|---|---|
| Operational | Assurance | Objectives, policies, good practice | Control tests, analytics, observation | Management; committee | 25 to 40 percent |
| Financial | Assurance | Accounting standards and policies | Reconciliations, substantive tests | CFO; committee; external auditor | 10 to 25 percent, more where SOX support is in the plan |
| Compliance | Assurance | Laws, regulations, contracts | Transaction and file tests against requirements | Compliance; regulators; committee | 10 to 30 percent; highest in regulated sectors |
| IT and cyber | Assurance | Frameworks, policies, configurations | Technical testing, logs, configurations | CIO, CISO; committee | 15 to 25 percent |
| Integrated | Assurance | Mixed, per risk | Process and IT tests together | Process owner; committee | The form most process audits should take |
| Performance | Assurance | Objectives, benchmarks, outcomes | Outcome and cost analysis | Executive; board; public | Dominant in government; growing elsewhere |
| Advisory | Advisory | Agreed with the client | Analysis, facilitation | Management | 10 to 20 percent |
| Investigative and forensic | Neither, strictly; governed by protocol | Facts and law | Forensic evidence, interviews | Counsel; committee | Reserve hours; 5 to 10 percent |
| Follow-up and validation | Assurance | The original finding and action | Re-tests of remediated controls | Committee; regulators | 5 to 15 percent; more in regulated banks |
| Continuous | Assurance | Encoded control rules | Automated exceptions | Function; management | A standing program; 5 to 10 percent |
| Thematic | Assurance | The theme’s standard | The same tests across units | Board | One or two a year |
| Project and pre-implementation | Assurance or advisory, stated | Governance standards, specifications | Stage-gate testing | Steering committee | As programs run |
| Third-party | Assurance | Program policy; contracts | Program and contract tests | Procurement; risk; committee | 5 to 10 percent |
| Quality and management-system | Assurance (often second-line) | ISO or scheme standards | Clause conformance checks | Quality; certification body | Usually relied on rather than performed |
| ESG and sustainability | Assurance | Reporting frameworks | Data lineage, program tests | Board; disclosure committee | Growing; one a year where reported |
Assurance or advisory: how the Standards divide them
The Global Internal Audit Standards recognize two kinds of service rather than fifteen kinds of audit: assurance, in which the function reaches an independent conclusion on governance, risk management or control for the board and management, and advisory, in which it gives advice or assistance at the client’s request without a conclusion. Thirteen of the fifteen types above are assurance in form (some, such as pre-implementation reviews, can be either and must say which); advisory is its own type; and investigations sit outside both in most functions’ methodologies, governed by the investigation protocol and counsel. The distinction matters for independence (an advisory engagement over a process impairs assurance over it until the safeguards are met), for reporting (assurance reports carry conclusions and ratings; advisory reports carry advice), and for the plan, which should show the split so the committee sees how much of the function’s capacity produces assurance. The Domain I guide gives the purpose both serve; the assurance versus advisory guide the rules.
Choosing the type in planning
| Question in planning | If the answer is … | The type is |
|---|---|---|
| What is the committee’s or management’s question about this area? | “Are the controls adequate and working?” | Operational, financial, IT or integrated assurance, by the risks |
| “Are we meeting the rule?” | Compliance | |
| “Is this program worth what it costs and achieving what it should?” | Performance | |
| “Help us design or prepare” | Advisory, with safeguards | |
| “Did someone do something wrong?” | Investigation under protocol | |
| “Was the fix real?” | Follow-up and validation | |
| Does the risk sit in one process or across many? | Across many | Thematic |
| Is the subject changing right now? | Yes, a program under way | Project or pre-implementation |
| Is the risk in a supplier? | Yes | Third-party |
| Can the control be tested by a rule on data? | Yes, at volume | Continuous auditing as a standing program |
| Is there a certified management system already audited by a competent function? | Yes | Rely on the quality audit after assessing it; audit the quality function itself periodically |
The type is recorded in the planning memo with the criteria it implies, and the engagement risk assessment then decides the procedures within it. Where an engagement needs two types (an operational audit that must also test compliance with a specific regulation), the memo says so and the report separates the conclusions.
The mix in a plan: MidState Beverage’s eight engagements
MidState Beverage, the three-state drinks distributor with a six-person internal audit function used in examples across this site, published its FY27 plan in full in the plan guide: eight engagements plus analytics, depot rotations and a reserve. Classified by type, the plan shows the mix a mid-size function carries.
| FY27 engagement | Hours | Type | Why that type |
|---|---|---|---|
| 1. Route cash | 520 | Operational, with financial and forensic elements | Controls over $31 million of driver-collected cash; MUS of balances; fraud statements in the risk assessment |
| 2. Acquisition integration | 750 | Project audit | Two unintegrated acquisitions; stage-gate assurance while integration runs |
| 3. ERP user access (with co-source) | 550 + 140 | IT audit | 412 users, 74 roles; access and segregation testing |
| 4. Warehouse inventory | 650 | Integrated (operational, financial, forensic) | Shrink of $410,000; the worked assessment |
| 5. Financial close | 550 | Financial | Close controls; journal entries; reconciliations |
| 6. ICFR support | 900 | Financial (management support, labeled) | Control testing for the lenders’ and board’s ICFR requirements, labeled as a management service |
| 7. Validation of 14 open FY26 findings | 450 | Follow-up and validation | Evidence-based closure; the committee’s past-due escalation |
| 8. Fleet and DOT advisory | 300 | Advisory | Management asked for help designing compliance monitoring; safeguards recorded for the FY28 assurance engagement |
| Analytics program | 600 | Continuous auditing | AP and payroll analytics on a schedule (the AP and payroll runs) |
| Depot rotations | 1,000 | Thematic | The same cash, inventory and access tests at twelve depots; outliers reported |
| Reserve (cyber program audit added in-year) | 960, of which 540 used | IT and cyber | The cyber program audit that found Level 2 maturity and eleven findings |
Eleven lines, nine types: the plan’s shape shows why a function needs the vocabulary. The ICFR support line is the one most functions mislabel, and MidState labels it as a management service so that the committee sees the 900 hours as support rather than assurance and the function’s independence over financial reporting controls stays visible; the four functions guide explains the stakes.
How types combine in practice
Most real engagements are hybrids, and the discipline is to name the primary type and the secondary ones rather than to pretend purity. A process audit is almost always integrated (operational and financial controls plus the application controls they depend on) and carries forensic statements in its risk assessment. A compliance audit of a regulated program is operational in its testing of the program’s processes. A third-party audit is a compliance audit of the contract and an operational audit of the oversight. A project audit swings between advisory (at design) and assurance (at readiness) and must say at each stage which it is. Investigations begin inside audits when a forensic analytic finds something, and the handoff to the protocol is the moment the type changes. What the labels do is keep the criteria and the conclusions separate within one report: a reader should be able to find the compliance conclusion, the control rating and the efficiency observations without them blurring into a single verdict, which the report anatomy guide shows how to lay out.
What each type means for the people being audited
| If you are told the audit is … | Expect | Prepare |
|---|---|---|
| Operational | Questions about how the process works and why; requests for procedures, metrics and samples of transactions; interviews with your team | Your process documentation and your own view of where it breaks; the year-round guide |
| Financial or SOX support | Requests for reconciliations, journal support, reports and sign-offs; precise evidence standards | Evidence retained as the control is performed; the control owner guide |
| Compliance | File reviews against specific rules; little room for “we do it differently” | The rule itself and your compliance records |
| IT or cyber | Configuration evidence, access lists, logs, change records; technical questions | System documentation and your administrators’ time |
| Advisory | A collaborative engagement you asked for; advice, not findings | A clear question; the distinction so you know what you are getting |
| Investigation | A different process under counsel’s direction; limited information about scope; interviews under rules | Cooperate; ask counsel what to expect; the when audit interviews you guide |
| Follow-up | Evidence that the action you committed to is implemented and working | The completion package before you assert completion |
Questions about types of internal audit
What are the main types of internal audit?
Operational, financial, compliance and IT audits are the core four; integrated audits combine them across a process; performance audits assess economy, efficiency and effectiveness; advisory engagements give advice without a conclusion; investigations establish facts; follow-up validates fixes; and continuous, thematic, project, third-party, quality and ESG audits address particular subjects or methods.
What is the difference between an operational audit and a compliance audit?
An operational audit measures a process against its objectives, policies and good practice and asks whether it is controlled and efficient; a compliance audit measures it against a specific law, regulation or contract and asks whether the requirement is met. The same process can receive both, with separate conclusions.
What is an integrated audit?
An engagement covering a process end to end across its operational, financial, compliance and technology dimensions with business and IT auditors on one team and one report; most process audits should take this form because process controls depend on the systems that run them.
Is an investigation a type of internal audit?
It is a different discipline that internal audit often performs: it establishes facts about an allegation under a protocol agreed with counsel, with evidence and interview rules that protect their later use, and produces findings of fact rather than a control conclusion. Forensic audits, which search populations for fraud, are planned as audits and may lead to investigations.
What is the difference between assurance and advisory services?
Assurance reaches an independent conclusion for the board and management; advisory gives advice or assistance at the client’s request without one. The Standards recognize these two services; most audit types are assurance, and advisory work over an area impairs assurance over it until safeguards are met.
How does a function decide which type an engagement is?
From the question the committee or management is asking (controls, compliance, value, help, facts, fixes), the spread of the risk (one process or many), whether the subject is changing, whether the risk sits in a supplier and whether the control can be tested by a rule on data. The type is recorded in the planning memo with the criteria it implies.
What mix of types should an audit plan have?
Mostly assurance across operational, financial, compliance and IT work, with 10 to 20 percent advisory, 5 to 15 percent follow-up and validation, reserve for investigations, and standing continuous auditing and thematic programs where the function has the data and the footprint. Regulated sectors carry more compliance and validation.
Related guides
- What does internal audit mean? — the purpose, process and value.
- Internal audit step by step for beginners — the process every type follows.
- Audit fieldwork: the complete guide — the work inside any type.
- Assurance vs advisory services — the Standards’ two kinds of service.
- GIAS Domain I — the purpose both serve.
- Engagement-level risk assessment — deciding the procedures within the type.
- Operational audit criteria — setting criteria when none exist.
- How to build the internal audit plan — MidState’s FY27 plan in full.
- Issue validation — the follow-up type.
- Continuous auditing — the automated type.
- When internal audit finds fraud — where an audit becomes an investigation.
- The CFE and the fraud allegation protocol — governing investigations.
- Third-party risk management program — the third-party type.
- ESG auditing — the sustainability type.
- Internal audits in an ISO 9001 system — the management-system type.
- SDLC and pipeline audit — project assurance.
- ERP segregation of duties — a thematic audit.
- Internal audit vs SOX vs compliance vs ERM — why ICFR support is labeled.
- Anatomy of an internal audit report — keeping conclusions separate.
- Navigating an internal audit: a guide for auditees — the other side.
Leave a Reply