Audit and Assurance · External audits

Internal vs External Audit and Other Assurance Services

Updated 11 October 2026 · Fact-checked

External audit is an independent opinion, required by law for many companies, on whether financial statements give a true and fair view, given to shareholders. Internal audit is an appointed function that evaluates risk, control and governance for management. Other assurance services give opinions on non-financial subject matter, such as sustainability or integrated reports.

Understand Internal vs External Audit and Other Assurance Services

Start with who the work is for. External audit is for the shareholders (members). The auditor is independent of the company and gives an opinion on the financial statements. In many countries this is a legal requirement for companies above a size threshold.

Internal audit is for management and those charged with governance. It is part of the entity, or outsourced to a provider. Its scope is set by management or the audit committee. It can cover controls, risk management, efficiency, compliance, fraud and value for money. Internal auditors can be employees, so their independence is relative, not absolute. They gain objectivity by reporting to the audit committee rather than to the finance director.

The two functions overlap. Both look at controls. The external auditor may use internal audit work if it is relevant and reliable. But the external auditor keeps sole responsibility for the opinion and never shares it with internal audit.

Other assurance services are engagements where a practitioner gives a conclusion that increases the confidence of intended users about a subject matter other than historical financial statements. Examples are sustainability or environmental reports, integrated reports, internal control reviews, and prospective financial information. These can give reasonable or limited assurance. Reasonable assurance gives a positive opinion. Limited assurance gives a negative-form conclusion (nothing has come to our attention). Related services such as agreed-upon procedures and compilations give no assurance at all.

An integrated report covers more than finance. It describes how the entity creates value over time using several capitals, such as financial, human, natural and social. Assurance on it is harder because much of the information is narrative, forward-looking, and has no single agreed framework. The practitioner needs suitable criteria, so the engagement must be accepted only if criteria are suitable and evidence is obtainable.

Key rules to remember

Who the report is for: External audit → members (shareholders). Internal audit → management / audit committee.; This is the starting point for almost every comparison.
Core comparison points: Objective | Reporting to | Independence | Scope | Legal status | Focus on financial statements or not; Use these as headings for any compare-and-contrast answer.
Assurance engagement elements: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written report; The same structure applies to sustainability and integrated report assurance.
Levels of assurance: Reasonable = positive opinion, high but not absolute. Limited = negative-form conclusion, moderate level.; Limited assurance needs less evidence work than reasonable assurance.

How to solve Internal vs External Audit and Other Assurance Services questions

Use this method for any question on internal versus external audit or other assurance services.

1Read the requirement verb. Compare, distinguish, explain or discuss all need different depth.
2Identify the entity and engagement: is it a financial statement audit, an internal audit role, or an assurance report on other subject matter?
3For comparisons, choose headings such as objective, reporting line, independence, scope, appointment and legal requirement. Write one point for each side under each heading.
4Apply the scenario. Link points to the entity facts, for example a company with no audit committee or a request for assurance on sustainability data.
5For other assurance, state the level of assurance, the subject matter, the criteria needed and the type of conclusion.
6Add a judgement where asked, such as whether the external auditor can rely on internal audit, or whether the engagement should be accepted.
7Check that each point earns a mark: one clear statement and, where needed, a short reason.

Quickest way: Who, what, why

When to use it: Use for Section A or OT case questions where you must pick the correct statement quickly.

Who receives the report? Shareholders point to external audit; management points to internal audit.
What is the subject? Financial statements point to external audit; controls, risk, efficiency point to internal audit; non-financial data points to other assurance.
Why is it done? Legal requirement points to external audit; management choice points to internal audit or other assurance.
Reject any option saying internal audit can give the audit opinion or that the external auditor is relieved of responsibility by using internal audit work.

Common mistakes in Internal vs External Audit and Other Assurance Services

Saying internal auditors are fully independent.
Students confuse objectivity with independence from the entity.
Fix: Say internal audit is not independent of the entity if staffed by employees. Objectivity is supported by reporting to the audit committee.
Writing that internal audit is only about financial statements.
Students copy the external audit scope across.
Fix: Remember internal audit can cover operations, value for money, compliance, risk and governance, as management decides.
Claiming external audit is required for every company.
The word statutory is read as universal.
Fix: State that audit is required by law for entities meeting the legal criteria in the jurisdiction. Some small entities may be exempt.
Giving a positive opinion for limited assurance.
Students blur the two levels.
Fix: Reasonable assurance gives a positive opinion. Limited assurance gives a negative-form conclusion.
Listing differences with no link to the scenario.
Students recall a memorised table.
Fix: Tie each point to the entity facts, such as who appointed the function or who it reports to.
Treating agreed-upon procedures as assurance.
Both involve a practitioner report.
Fix: Agreed-upon procedures report findings only. No conclusion is given, so no assurance is provided.

Worked examples

Example 1

Distinguish between external audit and internal audit in terms of objective, reporting and independence. (6 marks)

Show the solution

Objective: the external auditor gives an opinion on whether the financial statements are prepared, in all material respects, in accordance with the financial reporting framework. Internal audit objectives are set by management and may cover controls, risk, efficiency and compliance.
Reporting: the external auditor reports to the members, usually through the audit report. Internal audit reports to management or the audit committee, often through internal reports and recommendations.
Independence: the external auditor must be independent of the entity and follow ethical rules. Internal auditors are often employees, so they are less independent, though reporting to the audit committee improves objectivity.
Appointment: external auditors are appointed by the members, subject to law. Internal audit staff are appointed by management, or the service is outsourced.
Responsibility: the external auditor is solely responsible for the opinion. Management decides what action to take on internal audit findings.

Answer: External audit gives members an independent opinion on the financial statements. Internal audit serves management with a scope set by them. Independence is higher for external audit because internal auditors are normally part of the entity, although reporting to the audit committee helps their objectivity.

Example 2

A listed company asks its auditor to provide assurance on a sustainability report for investors. Explain what the practitioner should consider before accepting and what type of conclusion may be given. (6 marks)

Show the solution

Subject matter: check it is identifiable and capable of consistent evaluation, such as emissions data or social indicators.
Criteria: there must be suitable criteria against which the report is measured. These must be relevant, reliable and understandable. A lack of an agreed framework would be a concern.
Evidence: confirm the practitioner can obtain sufficient appropriate evidence. Narrative or forward-looking information may be harder to support.
Competence: the practitioner may need specialist skills and might need an expert.
Ethics and independence: check there are no threats from the engagement, such as self-review if the firm helped prepare the data.
Level of assurance: reasonable assurance gives a positive opinion and needs more work. Limited assurance gives a negative-form conclusion and needs less work. The level should be agreed in the engagement letter and the report must say which applies.

Answer: Accept only if the criteria are suitable, evidence can be obtained, the team is competent and independence is safeguarded. The conclusion will be a positive opinion for reasonable assurance, or a negative-form conclusion (nothing has come to our attention) for limited assurance.

Exam tips

For compare questions, use a clear layout with one point per side per heading. Do not write long essays on one side only.
In scenario questions, always say whether the internal audit work is relevant and reliable before suggesting the external auditor uses it. The external auditor keeps responsibility.
For other assurance, name the level of assurance and the form of the conclusion. These are easy marks.
In OT questions, watch for absolutes such as always, never or fully independent. They are usually wrong.
For integrated reporting, mention suitable criteria and the difficulty of evidencing narrative or forward-looking information.

Internal vs External Audit and Other Assurance Services in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal vs External Audit and Other Assurance Services: frequently asked questions

What is the main difference between internal and external audit?

External audit gives shareholders an independent opinion on the financial statements and is often required by law. Internal audit is a management function that evaluates controls, risk and operations. The scope of internal audit is set by management or the audit committee.

Can the external auditor rely on internal audit work?

Yes, if the work is relevant to the audit and reliable. The auditor assesses the function's objectivity, competence and quality of work. The external auditor still has sole responsibility for the audit opinion.

What are other assurance services in ACCA AA?

They are engagements that give a conclusion on subject matter other than historical financial statements. Examples include sustainability reports, integrated reports and internal control reviews. They may give reasonable or limited assurance.

What is integrated reporting assurance?

It is an engagement where a practitioner gives a conclusion on an integrated report, which explains how an entity creates value using several capitals. The practitioner needs suitable criteria and sufficient appropriate evidence. This is harder where information is narrative or forward-looking.