Business and Technology · Internal controls

Internal Audit Function: Role, Scope and Independence

Updated 11 October 2026 · Fact-checked

Internal audit is an appraisal activity inside an organisation that evaluates and improves risk management, internal control and governance. Management decides its scope. It reports to the audit committee or board. Unlike external audit, it does not give an opinion on the financial statements for shareholders. To answer questions, link the point to who it serves, its scope and its independence.

Understand Internal Audit Function

An internal audit function is a team, in-house or outsourced, that reviews how the organisation works. It checks whether controls are designed well and operating, whether risks are managed, and whether the business follows laws, policies and procedures. It is part of the monitoring of internal controls.

The scope is wide and set by management or the audit committee. Typical work covers: reviewing the internal control system, examining financial and operating information, testing value for money (economy, efficiency and effectiveness), checking compliance with laws and policies, reviewing safeguarding of assets, assessing risk management, and sometimes investigating fraud. Internal audit can look at any area, not only the accounts.

Independence is what makes the work credible. An internal auditor is usually an employee, so true independence is limited. You protect it by reporting to the audit committee or board, not to the finance director whose area may be reviewed. You also protect it by giving the function a clear charter, free access to records and staff, no operational duties in the areas audited, and a head of internal audit who cannot be removed without audit committee approval. Where there is no audit committee, a senior director or the board takes this role.

External audit is different. The external auditor is appointed by the shareholders, is independent of the company, and gives an opinion on whether the financial statements give a true and fair view (or present fairly). External audit is usually required by law for larger companies. Internal audit is a management tool and may not be legally required, though governance codes often expect a company to consider having one.

A company may also choose between an in-house and an outsourced function. In-house staff know the business well. Outsourcing can bring specialist skills and greater independence, but may cost more or know the business less. Internal and external auditors may co-operate, and the external auditor may rely on internal audit work after assessing it.

Key formulas to remember

Internal audit purpose: Internal audit = independent review of risk management, control and governance to help management; Serves management and the board. It is not primarily for shareholders.
External audit purpose: External audit = independent opinion on whether the financial statements are fairly presented; Serves shareholders. Appointed by shareholders, usually a legal requirement for larger companies.
Value for money (the three Es): Economy + Efficiency + Effectiveness; Internal audit often tests these. Economy is low cost of inputs, efficiency is output per input, effectiveness is achieving objectives.
Independence reporting line: Internal audit → audit committee (or board); Not to the managers whose work is being audited.

How to solve Internal Audit Function questions

Use this method for any question on internal audit, whether it asks about role, scope, independence or comparison with external audit.

1Identify what is asked: role, scope, independence, or a comparison.
2Decide who the work serves: management and the board for internal audit, shareholders for external audit.
3For scope, list areas: controls, risk management, compliance, value for money, information reliability, asset safeguarding, fraud.
4For independence, check the reporting line, the auditor's other duties, access to records and who controls hiring and removal.
5For a comparison, use fixed headings: appointment, objective, reporting, scope, independence, legal requirement.
6For multiple response, test each option against the headings and select exactly the number requested.
7Check your answer names the correct party and does not mix up the two types of audit.

Quickest way: Who, what, to whom

When to use it: Use for objective test questions where you have about a minute.

Ask who appoints the auditor: management or board means internal, shareholders means external.
Ask what is reported: control and operations advice means internal, opinion on financial statements means external.
Ask to whom it reports: audit committee or board means internal, members or shareholders means external.
For independence questions, pick the option that removes reporting to the audited area.

Common mistakes in Internal Audit Function

Saying internal audit gives an opinion on the financial statements to shareholders.
Students blend the two types of audit because both are called audit.
Fix: Link the true and fair opinion only to external audit. Internal audit reports to management and the audit committee.
Treating internal audit as legally required for all companies.
Statutory external audit is well known, so students assume the same for internal audit.
Fix: Remember internal audit is generally a management decision, though governance codes encourage it.
Limiting internal audit scope to financial controls.
Students think audit means accounts.
Fix: Include operational areas, value for money, compliance, risk management and fraud reviews.
Saying internal auditors are fully independent because they audit.
Students ignore that they are usually employees.
Fix: Say independence is limited, and is protected by reporting to the audit committee, free access and no operational role.
Suggesting internal audit should design and run the controls it reviews.
Students think helping management means doing management's work.
Fix: Management owns controls. Internal audit evaluates and recommends. Running them creates a self-review threat.

Worked examples

Example 1

Which ONE of the following best describes a feature of internal audit rather than external audit? A) Appointed by the shareholders B) Gives an opinion on whether the financial statements give a true and fair view C) Scope is determined by management or the audit committee D) Usually legally required for larger companies

Show the solution

Option A is how external auditors are appointed, so it is external.
Option B is the external auditor's opinion, so it is external.
Option D describes statutory audit, so it is external.
Option C matches internal audit, whose scope is set by management or the audit committee.

Answer: C

Example 2

The head of internal audit at a company reports to the finance director, whose department is due to be audited. Explain the independence problem and suggest two ways to improve it.

Show the solution

Identify the problem: the finance director can influence the head of internal audit's findings, pay or career, so objectivity is threatened and findings may be softened or ignored.
Improvement 1: change the reporting line so the head of internal audit reports to the audit committee or board.
Improvement 2: give the function a formal charter with free access to records and staff, and require audit committee approval to appoint or remove the head.
Optional: avoid giving internal auditors operational duties in areas they review.

Answer: Reporting to the finance director weakens independence because the auditor may be influenced by the person being reviewed. Improve it by reporting to the audit committee and by giving a formal charter with full access, plus audit committee control over appointment and removal of the head.

Exam tips

Most questions test the contrast with external audit. Memorise appointment, objective, reporting and legal requirement.
For independence, always mention the reporting line to the audit committee first.
In multiple response questions, read the number to select and eliminate options that describe the external auditor's opinion.
If asked about scope, think beyond accounts: operations, compliance, risk and value for money.

Practice questions from Internal controls

Internal Audit Function in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function: frequently asked questions

What is the main difference between internal and external audit?

Internal audit is set up by management to review controls, risks and operations and reports to management or the audit committee. External audit is carried out by independent auditors appointed by shareholders to give an opinion on the financial statements.

How is internal audit independence protected?

The function should report to the audit committee or board, have a clear charter and free access to records, and avoid operational duties in areas it audits. The audit committee should approve the appointment and removal of the head.

Is internal audit compulsory?

Generally not by law, as it is mainly a management decision. Governance codes often expect larger or listed companies to consider whether they need one.

Can a company outsource internal audit?

Yes. Outsourcing can bring specialist skills and may improve independence. The drawbacks can include cost and less knowledge of the business than in-house staff.