Business and Technology · Accounting and finance functions within business organisations

Internal and External Audit and Finance Function Controls

Updated 11 October 2026 · Fact-checked

Internal audit is a function inside the organisation that reviews controls, risk and efficiency for management. External audit is an independent check by outside auditors, who give an opinion on whether the financial statements are true and fair. The finance function supports both through controls that prevent and detect fraud and error.

Understand Internal and External Audit and Finance Function Controls

Every organisation needs to know that its money and records can be trusted. The finance function helps by setting up controls: rules and checks that protect assets, keep records accurate and make sure laws are followed. Audit is the way those controls and records are checked.

Internal audit is carried out by staff of the organisation, or by an outsourced firm appointed by it. It reports to management or the audit committee. Its scope is wide. It can review internal controls, risk management, compliance, efficiency and value for money, and it can investigate suspected fraud. It is not a legal requirement for most companies, so the organisation chooses to have it.

External audit is carried out by an independent firm of auditors. It is usually required by law for larger companies. Auditors are appointed by and report to the shareholders, not to management. Their main job is to give an opinion on whether the financial statements give a true and fair view and are prepared in line with the reporting framework. They look at controls only to decide how much testing they need to do.

Fraud is deliberate deception to gain an unfair or illegal advantage. Fraud prevention means designing controls so fraud is hard to commit. Examples are segregation of duties, authorisation limits, restricted access to systems and physical security of assets. Detection controls, such as reconciliations, exception reports and internal audit reviews, find problems after they occur. Compliance means following laws, regulations and internal policies. Finance staff, internal audit and the board all share responsibility for it.

As a rule, management is responsible for the financial statements, for internal controls and for preventing fraud. Auditors do not take over that responsibility.

Key formulas to remember

Internal audit: who, to whom, scope: Internal audit = employee or appointed by the organisation → reports to management or audit committee → scope set by the organisation; Not usually required by law. Focus is controls, risk, efficiency and compliance.
External audit: who, to whom, scope: External audit = independent of the organisation → reports to shareholders → opinion on true and fair view of the financial statements; Usually a legal requirement for larger companies. Gives an opinion, not a guarantee.
Fraud risk factors: Opportunity + Pressure + Rationalisation; Often called the fraud triangle. Controls mainly reduce opportunity.
Control types: Preventive (stop it) | Detective (find it) | Corrective (fix it); Classify each example control into one of these types.
Responsibility rule: Management: prepares statements and runs controls. Auditor: gives an opinion.; The external auditor does not prepare the accounts or prevent fraud.

How to solve Internal and External Audit and Finance Function Controls questions

Use this method for any question on audit, controls, fraud or compliance.

1Read the question and identify the task word: distinguish, explain, identify or recommend.
2Decide whether it asks about internal audit, external audit, controls or fraud. Some questions compare two of these.
3For a comparison, use fixed headings: who does it, who they report to, purpose, scope and legal requirement.
4For a control question, name the control, then say what risk it addresses and whether it is preventive, detective or corrective.
5For a fraud scenario, find the weakness in the facts, such as one person handling cash and records, or no review of changes.
6Match your answer to the facts given. Do not give generic textbook points.
7Check the number of options required in multiple response questions, then re-read before you submit.

Quickest way: Who, to whom, why

When to use it: Use this for objective test questions that ask you to tell internal audit from external audit or match a statement to one of them.

Ask: is this person independent of the organisation, and appointed by shareholders? If yes, it is external audit.
Ask: does the work focus on controls, risk or efficiency for management? If yes, it is internal audit.
Ask: is the output an opinion on the financial statements? That points to external audit.
For control questions, ask what could go wrong and what stops it, finds it or fixes it.
Eliminate options that say auditors are responsible for preventing fraud or preparing accounts.

Common mistakes in Internal and External Audit and Finance Function Controls

Saying internal audit is independent in the same way as external audit.
The word audit makes both sound the same.
Fix: Internal auditors are part of or appointed by the organisation and report to management or the audit committee. Their objectivity is protected by reporting lines, but they are not independent in the legal sense that external auditors are.
Stating that the external auditor is responsible for preventing and detecting fraud.
Students assume an audit guarantees the accounts are fraud free.
Fix: Management is responsible for preventing fraud. The auditor gives an opinion and plans work to have a reasonable chance of finding material misstatement.
Thinking external audit is optional and internal audit is compulsory.
The two are mixed up.
Fix: Remember: external audit is usually required by law for larger companies. Internal audit is usually a choice made by the organisation.
Listing controls without linking them to a risk.
Students memorise lists of controls.
Fix: For each control, add a short because clause. For example, segregation of duties reduces the chance that one person can commit and hide fraud.
Confusing preventive and detective controls.
A control can look like it does both.
Fix: Ask when it acts. Before the event is preventive, such as authorisation. After the event is detective, such as a bank reconciliation.
Saying the external auditor reports to the finance director.
Students see the auditor working with the finance team every day.
Fix: They work with finance staff but report to shareholders. Say this clearly in any comparison.

Worked examples

Example 1

Distinguish between internal audit and external audit by giving three differences.

Show the solution

Use clear headings: reporting line, purpose and legal requirement.
Reporting line: internal audit reports to management or the audit committee. External audit reports to the shareholders.
Purpose: internal audit reviews controls, risk, efficiency and compliance and can investigate fraud. External audit gives an opinion on whether the financial statements are true and fair.
Legal requirement: internal audit is usually chosen by the organisation. External audit is usually required by law for larger companies.

Answer: Internal audit reports to management or the audit committee, covers controls, risk and efficiency, and is usually voluntary. External audit reports to shareholders, gives an opinion on the financial statements, and is usually a legal requirement for larger companies.

Example 2

A clerk at a company raises purchase orders, receives goods, approves supplier invoices and prepares the payment run. Identify the fraud risk and recommend two controls.

Show the solution

Find the weakness: one person controls the whole purchasing cycle. This gives the opportunity to create a false supplier or approve false invoices and hide it.
Control 1: segregation of duties. Split ordering, receiving, invoice approval and payment between different people. This is preventive because it stops one person completing a fraud alone.
Control 2: independent review of the payment run and supplier list changes by a manager before payment. This is preventive for the payment and detective for false suppliers.
Optional: internal audit could carry out regular checks of supplier records. This is detective.

Answer: The risk is fraud or error from one person controlling the whole purchasing cycle. Recommended controls are segregation of duties between ordering, receiving, approving and paying, and independent management review of the payment run and supplier changes.

Exam tips

Objective test questions often give a short statement and ask which type of audit it describes. Check who the report goes to first.
In multiple response questions, select exactly the number stated. Do not pick a statement that gives the auditor responsibility for fraud prevention.
For number entry, this topic rarely needs calculations, so use the saved time to re-read scenario questions.
In scenario questions, find the control weakness in the facts, then choose the answer that fixes that exact weakness.
Learn the three control types and give one example of each so you can classify quickly.

Practice questions from Accounting and finance functions within business organisations

Internal and External Audit and Finance Function Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal and External Audit and Finance Function Controls: frequently asked questions

What is the main difference between internal and external audit?

Internal audit is done for management by people inside or appointed by the organisation and reviews controls, risk and efficiency. External audit is done by independent auditors for the shareholders and gives an opinion on the financial statements.

Is the external auditor responsible for finding fraud?

No. Management is responsible for preventing and detecting fraud through internal controls. The auditor plans the audit to have a reasonable chance of finding material misstatements, including those caused by fraud, but cannot guarantee it.

How do I explain fraud prevention controls in a finance department?

Name the control, state the risk it addresses and say how it works. Examples are segregation of duties, authorisation limits, restricted system access, reconciliations and safe custody of assets. Link each one to the fraud opportunity it removes.

Does the finance function carry out audit?

No. The finance function operates many of the controls and provides the records that are audited. Internal and external auditors review that work independently of the finance team.