Audit and Assurance · Internal audit and governance and the differences between external audit and internal audit

Internal Audit Function and Its Role in Governance

Updated 11 October 2026 · Fact-checked

Internal audit is an appraisal activity set up by management or those charged with governance to evaluate and improve risk management, internal control and governance. It gives assurance and advice to management and the audit committee. In the exam, link each point to the scenario.

Understand Internal Audit Function and Its Role in Governance

Internal audit is a function within or for an entity. It reviews the entity's own operations and systems. It is not required by law for most companies, and the entity decides whether to have one and what it does.

Its work is usually described in three areas: risk management, internal control and governance. Internal audit evaluates whether risks are identified and managed. It tests whether controls are designed well and operate as intended. It reviews whether governance processes, such as reporting lines and ethical standards, work in practice.

Internal audit also has other roles. It can review financial and operating information, check compliance with laws and regulations, carry out value for money reviews, support fraud investigations, and review the entity's IT systems. The scope is set by management or the audit committee, so it varies a lot between entities.

In governance, internal audit supports the board and the audit committee. It gives them independent information on how well controls and risk processes work. This helps directors meet their duty to maintain sound internal control. For this to work, internal audit needs independence: ideally a direct reporting line to the audit committee, not to the finance director whose area it reviews.

The internal auditor does not replace management. Management stays responsible for internal control. Internal audit reports on it and recommends improvements. The external auditor is separate: that role is to give an opinion on the financial statements to shareholders.

Key rules to remember

Three areas of internal audit scope: Risk management + Internal control + Governance; Use these as a checklist to structure any answer on the role of internal audit.
Other typical internal audit activities: Financial and operating information review; value for money; compliance with laws; fraud work; IT review; Scope is set by management or the audit committee, so it is not fixed.
Key responsibility rule: Management owns internal control; internal audit evaluates and advises; Never say internal audit is responsible for the control system.
Independence rule: Independence comes from reporting to the audit committee and having no operational duties; Internal audit is organisationally independent of the areas it audits, but is still part of the entity.

How to solve Internal Audit Function and Its Role in Governance questions

Use this method for any question on the role of internal audit or its link to governance.

1Read the requirement and note the verb: describe, explain, discuss or recommend.
2Identify the entity: size, structure, listing status, risks, and whether it has an audit committee.
3Use the three-area checklist: risk management, internal control, governance. Add other activities if relevant.
4For each point, say what internal audit does and why it helps the board or audit committee.
5Link every point to a fact in the scenario, such as a new system, fraud, or rapid growth.
6Comment on independence and reporting lines if the scenario hints at weakness.
7Finish with a clear conclusion or recommendation if the requirement asks for one.

Quickest way: Checklist then link

When to use it: For short objective questions and for 4-6 mark written parts when time is tight.

Write the three words: risk, control, governance.
Pick the two or three that fit the question.
State the action and the benefit to the board in one sentence each.
Add one scenario fact to each point.
Check that you have not given internal audit responsibility for control, or confused it with external audit.

Common mistakes in Internal Audit Function and Its Role in Governance

Saying internal audit is responsible for the internal control system.
The word 'audit' makes students think the function owns the checking and the system.
Fix: Management is responsible for designing and operating controls. Internal audit evaluates them and recommends improvements.
Mixing up internal and external audit objectives.
Both involve testing and reporting, so they seem alike.
Fix: External audit gives an opinion on the financial statements to shareholders. Internal audit's work is set by management or governance and reports to them.
Listing generic duties with no link to the scenario.
Students memorise a list and write it out.
Fix: Tie each duty to a fact in the question, such as a new IT system or weak controls at a subsidiary.
Ignoring independence and reporting lines.
Students focus on tasks, not on how the function is positioned.
Fix: Say that internal audit should report to the audit committee or non-executive directors, and should not audit areas it operates.
Assuming every company must have internal audit.
Listed company codes expect it, so students generalise.
Fix: For most entities it is a choice. The need depends on factors such as size, complexity, risk and the cost-benefit of having it.

Worked examples

Example 1

A listed company is considering setting up an internal audit function. The board asks you to explain how internal audit would support the company's corporate governance. (6 marks)

Show the solution

Identify the entity: listed, so it has a board and an audit committee and shareholders expect strong governance.
Risk management: internal audit can review whether the company identifies and assesses risks and whether responses work. This helps the board meet its duty to manage risk.
Internal control: it can test whether controls operate as designed and report weaknesses with recommendations. This supports the board's review of control effectiveness.
Governance: it can review compliance with the governance code, ethical policies and reporting lines, and give the audit committee independent information.
Independence: it should report to the audit committee so its findings are not filtered by managers it reviews.
Other support: it can help with fraud investigations and compliance checks, which adds assurance for the board.

Answer: Internal audit supports governance by evaluating risk management, internal control and governance processes, and reporting independently to the audit committee. It gives the board assurance and practical recommendations, while management stays responsible for the controls themselves.

Example 2

Which ONE of the following best describes the role of internal audit? A. Giving an opinion on the truth and fairness of the financial statements to shareholders. B. Designing and operating the company's internal control system. C. Evaluating and advising on risk management, control and governance processes for management and the audit committee. D. Approving directors' remuneration.

Show the solution

Option A is the external auditor's role, so it is wrong.
Option B is management's responsibility. Internal audit evaluates controls but does not own them.
Option D is a remuneration committee matter, not internal audit.
Option C matches the accepted description of internal audit scope and its audience.

Answer: C

Exam tips

Use risk management, control and governance as a structure for any written answer on internal audit's role.
Always link points to the scenario. Generic lists score poorly in constructed response.
In objective questions, watch for options that give internal audit responsibility for controls or an opinion to shareholders. These are usually the wrong answers.
Mention independence and the audit committee reporting line when a question asks how internal audit can be effective.
Remember the scope is decided by management or the audit committee, so say 'may' or 'can' rather than 'must'.

Internal Audit Function and Its Role in Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function and Its Role in Governance: frequently asked questions

What is the role of internal audit in ACCA AA?

Internal audit evaluates and improves risk management, internal control and governance. It reports to management and the audit committee. Its work is set by the entity, not by law in most cases.

How does internal audit support corporate governance?

It gives the board and audit committee independent information on whether controls and risk processes work. It can also review compliance and support fraud investigations. This helps directors meet their governance duties.

Is internal audit the same as external audit?

No. External audit gives an opinion on the financial statements to shareholders and is independent of the entity. Internal audit works for the entity, with scope set by management or the audit committee.

Who should internal audit report to?

Ideally it reports to the audit committee or to non-executive directors. This protects its independence from the managers whose areas it reviews.