Audit and Assurance · Internal audit and governance and the differences between external audit and internal audit

Differences Between External and Internal Audit for ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

External audit is an independent opinion on whether financial statements give a true and fair view, required by law for many entities and reported to shareholders. Internal audit is an in-house function that evaluates risk management, controls and governance, reporting to management or the audit committee. Scope, objective, independence and appointment all differ.

Understand Differences Between External and Internal Audit

Both external and internal auditors check things and report on them. That is why students mix them up. The difference lies in who they work for, what they check and why.

External audit exists to give an opinion on the financial statements. The auditor is independent of the company. Shareholders (the members) appoint the auditor, and the auditor reports to them. For many companies the audit is required by law. The auditor gives reasonable assurance, not absolute assurance.

Internal audit is an appraisal activity set up by the entity itself. Management or those charged with governance decide whether to have it, what it covers and who does it. It can be an in-house team or outsourced. It helps the entity by evaluating and improving risk management, internal control and governance. It has no legal requirement for most entities, though governance codes encourage it for larger listed companies.

Independence works differently. The external auditor must be independent of management and the entity in both mind and appearance. Internal auditors are employees (or contractors) so they cannot be independent in the same way. They aim for objectivity, helped by reporting lines to the audit committee and not to the finance director.

The two can work together. The external auditor may use the work of internal audit, but only after assessing it. The external auditor keeps sole responsibility for the opinion and does not mention the reliance in the auditor's report. Internal auditors may also be asked to do work that supports the external audit, which is called direct assistance in some contexts and needs careful controls.

Key rules to remember

Objective: External: opinion on financial statements. Internal: improve risk management, control and governance.; Use this as the first line of any comparison answer.
Reporting: External: to members (shareholders). Internal: to management or the audit committee.; The internal audit reporting line affects its objectivity.
Appointment: External: members appoint, by law. Internal: management or those charged with governance decide.; Say who can remove them as well if asked about independence.
Assessing internal audit before reliance: Objectivity, technical competence, due professional care, and communication between the two.; Use these four factors to answer any question on whether the external auditor can rely on internal audit.
Responsibility: External auditor keeps sole responsibility for the opinion, even if internal audit work is used.; Never say the responsibility is shared or reduced.

How to solve Differences Between External and Internal Audit questions

For any question comparing or linking the two functions, use a fixed structure so you never miss a point.

1Read the requirement. Decide whether it asks for differences, for reliance, or for both.
2List the comparison headings: objective, who appoints, who reports to, independence, scope, legal requirement, and nature of assurance.
3For each heading, write one point about external audit and one about internal audit. Make the contrast clear in the same sentence.
4If the scenario gives details, such as an internal auditor reporting to the finance director, link your point to those facts.
5For reliance questions, assess the four factors: objectivity, competence, due care, and communication.
6Add the effect on the audit approach: the nature, timing and extent of procedures may change, but the external auditor keeps responsibility.
7Finish with a short conclusion if the requirement asks you to advise or recommend.

Quickest way: The OARIS check

When to use it: Use it for a Section C written answer or a quick comparison point in an OT case when you have only a few minutes.

O: Objective. Opinion on the financial statements versus improving controls and governance.
A: Appointment. Members, by law, versus management, by choice.
R: Reporting. To members versus to management or the audit committee.
I: Independence. Independent of the entity versus part of it, aiming for objectivity.
S: Scope. Financial statements versus any area the entity chooses, such as operations and compliance.
Write one balanced sentence per letter and you will normally cover the marks.

Common mistakes in Differences Between External and Internal Audit

Saying internal audit is independent in the same way as external audit.
Both words contain 'audit', so students assume the same standard of independence applies.
Fix: Say internal auditors are employees and aim for objectivity, helped by reporting to the audit committee. Only the external auditor must be independent of the entity.
Stating that internal audit is required by law for all companies.
Students confuse it with the statutory external audit.
Fix: Say that internal audit is a management decision. Governance codes encourage it for larger listed companies, but it is not a general legal requirement.
Saying the external auditor shares responsibility when relying on internal audit.
It seems fair that reliance should transfer some of the blame.
Fix: State that the external auditor has sole responsibility for the opinion. Reliance only changes the audit procedures, and the report does not refer to it.
Saying external audit looks at the future and internal audit looks at the past.
Students invent a neat contrast that is not accurate.
Fix: Use real differences: external audit focuses on historic financial statements. Internal audit can look at any area, including controls, efficiency and risk, and can be forward looking.
Listing differences without applying them to the scenario.
Students recall a memorised table and write it out.
Fix: Use scenario facts, such as the reporting line or the competence of the team, and make each point relevant to the question asked.
Forgetting to assess internal audit before relying on it.
Students assume that having an internal audit department means the work is reliable.
Fix: Always say the external auditor must evaluate objectivity, competence, due care and communication before using the work.

Worked examples

Example 1

Compare external audit and internal audit in terms of objective, appointment, reporting and independence. (8 marks)

Show the solution

Objective: the external auditor expresses an opinion on whether the financial statements are prepared in all material respects in accordance with the applicable framework. Internal audit evaluates and improves risk management, control and governance, as decided by the entity.
Appointment: members appoint the external auditor, as required by law for most companies. Management or those charged with governance decide whether to have an internal audit function and appoint the staff.
Reporting: the external auditor reports to the members in the auditor's report and to those charged with governance on matters of governance interest. Internal audit reports to management or, ideally, the audit committee.
Independence: the external auditor must be independent of the entity in mind and appearance. Internal auditors are employees or contractors, so they cannot be independent in that sense, but should be objective, which the reporting line to the audit committee supports.
Scope: the external audit is limited to the financial statements. Internal audit can cover any area, such as operations, compliance and value for money.

Answer: External audit gives an independent opinion to members, by law, on the financial statements. Internal audit is an in-house function, set up by management, that improves risk management, control and governance, and reports to management or the audit committee. The external auditor must be independent. The internal auditor aims for objectivity.

Example 2

Bluebell Co is a manufacturer with an internal audit department of six staff. The head of internal audit reports to the finance director. Staff are qualified accountants who follow a work programme and review each other's files. The external auditor wants to use the department's testing of inventory counts. Discuss whether the external auditor can rely on this work. (6 marks)

Show the solution

Start with the principle: the external auditor may use internal audit work but must first assess it. The external auditor keeps sole responsibility for the opinion.
Objectivity: the head of internal audit reports to the finance director, whose area is audited. This weakens objectivity. The external auditor should ask whether there is a link to the audit committee and consider how much weight to give the work.
Competence: staff are qualified accountants, which supports technical competence. The external auditor should confirm experience of inventory procedures.
Due professional care: the use of a work programme and file reviews suggests the work is planned, supervised and documented. The external auditor should test a sample of the work.
Communication: the auditors should agree the timing and extent of work and share findings so that the external auditor can evaluate the results.

Answer: The external auditor can probably rely on the work, but with caution. Competence and due care look good. The reporting line to the finance director weakens objectivity, so the external auditor should test some of the work again and may reduce reliance on it. Responsibility for the opinion stays with the external auditor.

Exam tips

Answer a 'differences' requirement with paired points. State the external position and the internal position in the same sentence so the contrast is clear.
In reliance questions, use the four factors as headings: objectivity, competence, due care and communication. Then apply each to the scenario facts.
Do not write that internal audit is compulsory or that responsibility is shared. These statements lose marks.
In an OT case, look for the keyword in the option: opinion, appointed by members, reports to management. This usually points to the correct answer quickly.
Where the scenario shows a weakness, such as a reporting line to the finance director, say how it affects the external auditor's reliance and recommend a response.

Differences Between External and Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Differences Between External and Internal Audit: frequently asked questions

What is the main difference between external and internal audit?

The main difference is purpose and independence. External audit gives an independent opinion on the financial statements to the members. Internal audit is an in-house activity that helps management improve risk management, control and governance.

Can the external auditor rely on internal audit work?

Yes, but only after assessing it. The external auditor considers objectivity, competence, due professional care and communication. Even where the work is used, the external auditor keeps sole responsibility for the opinion.

Is internal audit compulsory?

Not generally. It is a decision for management and those charged with governance. Governance codes encourage larger listed companies to consider having it, and an explanation is needed if there is none.

Who appoints and removes the internal auditor?

Management or those charged with governance, such as the audit committee, decide this. Having the audit committee involved in appointment and removal helps protect objectivity. The external auditor is appointed by the members.