Skip to content

Audit and Assurance · Internal audit and governance and the differences between external audit and internal audit

Need for Internal Audit and the Factors That Affect It

Updated 11 October 2026 · Fact-checked

A company needs internal audit when the benefit of independent review of risk, controls and governance outweighs its cost. Key factors are scale and diversity of operations, complexity, number of employees, regulatory requirements, risk and control weaknesses, management attitude, and cost-benefit. Listed companies are usually expected to consider it.

Understand Need for Internal Audit and Factors Affecting It

Internal audit is an appraisal activity set up by management or those charged with governance. It reviews risk management, internal control and governance, and it adds value by helping the company reach its objectives. Unlike external audit, it is rarely required by law for most companies.

Because it is not compulsory for most entities, the question is always: does this company need it? The answer is a judgement. You weigh the benefits of independent assurance against the cost of running the function.

The main factors that push a company towards having internal audit are:

  • Scale, diversity and complexity of operations. Many sites, countries or product lines make it hard for directors to see everything themselves.
  • Number of employees. More staff means more delegated work and more chance of error or fraud.
  • Cost-benefit. The savings and protection from internal audit must exceed its cost.
  • Legislation and regulation. Some sectors, such as financial services, must have one. Corporate governance codes for listed companies usually require the board to review annually whether one is needed, and to explain if there is none.
  • Risk and control concerns. Past fraud, errors, weak controls or fast change raise the need.
  • Management attitude. Management that values control and wants assurance is more likely to use internal audit well.
  • Organisational structure and culture. A complex or decentralised structure, or a weak control culture, increases the need.

The factors that argue against it are the reverse. A small, simple business with a few staff, direct owner-manager oversight and tight cost limits may reasonably have no internal audit. Management can often monitor controls itself.

In the exam, you are rarely asked to give a verdict only. You must apply the factors to the scenario facts and conclude.

Key rules to remember

Core decision rule
Internal audit is justified if benefits of independent assurance > cost of the function
A judgement, not a calculation. Support it with scenario facts.
Factors increasing the need
Scale + diversity + complexity + staff numbers + regulation + risk/control weaknesses + supportive management
Use as a checklist and link each to the scenario.
Factors reducing the need
Small size + simple operations + close owner/management oversight + high cost relative to benefit
Use when the scenario describes a small, simple entity.
Governance codes position
Listed companies: board reviews annually whether internal audit is needed; if none, explains why
Describe this as general code practice and avoid quoting clause numbers.

How to solve Need for Internal Audit and Factors Affecting It questions

Use this method for any question asking whether a company needs internal audit or what factors to consider.

  1. 1Read the requirement. Check whether it asks for factors, a recommendation, or both.
  2. 2Underline scenario facts: size, staff, locations, sector, listing, past errors, control issues, budget.
  3. 3List the relevant factors from the checklist. Do not write all of them if the scenario does not support them.
  4. 4For each factor, state the fact, then say whether it increases or reduces the need.
  5. 5Consider cost against benefit. Mention if outsourcing or a smaller function could reduce cost.
  6. 6Conclude clearly: needed, not needed, or needed in a limited form. Give the main reason.
  7. 7Check that every point links to the scenario rather than being generic.

Quickest way: Fact, factor, effect

When to use it: Use for a requirement within a constructed response question in Section B, where time is limited.

  1. Pick the scenario facts that stand out, usually four to six.
  2. Write one line for each: 'Fact (company has 12 sites) so factor (complexity) so need is higher.'
  3. Add one line on cost-benefit.
  4. Finish with a one-sentence conclusion.
  5. Skip any factor the scenario gives no evidence for.

Common mistakes in Need for Internal Audit and Factors Affecting It

  • Saying every company must have internal audit.

    Students confuse it with statutory external audit.

    Fix: State that it is generally not legally required, except in some regulated sectors, and is a management decision.

  • Listing factors without applying them.

    Students memorise a list and write it out.

    Fix: Tie each factor to a scenario fact and say whether it raises or lowers the need.

  • Ignoring cost-benefit.

    Focus is only on the benefits of control.

    Fix: Always include a cost point, especially for small entities, and mention outsourcing as an option.

  • Giving no conclusion.

    Students run out of time or think listing is enough.

    Fix: End with a clear recommendation and its main reason.

  • Mixing up need for internal audit with the need for external audit.

    Both use the word audit and both relate to size.

    Fix: External audit depends on law and exemptions. Internal audit depends on management and governance needs.

  • Treating small size as a total bar.

    Students overstate small size as a rule.

    Fix: Say a small company may not need it, unless risk, regulation or control weakness suggests otherwise.

Worked examples

Example 1

Pinecone Ltd is a private company with 15 employees and one office. The owner-manager approves all payments and supervises daily operations. The owner asks whether Pinecone needs an internal audit function. Discuss.

Show the solution
  1. Size and complexity: 15 staff and one office mean operations are simple, so the owner can see most activity directly. This reduces the need.
  2. Management oversight: the owner approves all payments, so control is close and direct. Internal audit would add little extra assurance.
  3. Cost-benefit: a full-time function would be expensive relative to the company's size, and the benefits are likely to be small.
  4. Regulation: Pinecone is private and the scenario gives no sector regulation, so nothing requires it.
  5. Risk: the scenario gives no past fraud or control failures. However, reliance on one person is a risk if the owner is absent or misuses authority.

Answer: Pinecone does not need a full internal audit function. It is small, simple, and closely supervised, and the cost would exceed the benefit. The owner could consider an occasional outsourced review of controls if the business grows or risks increase.

Example 2

Harbour plc is a listed bank operating in eight countries with 6,000 staff. It has no internal audit function and the board argues it is too costly. Evaluate whether this view is reasonable.

Show the solution
  1. Scale and complexity: eight countries and 6,000 staff mean the board cannot monitor operations directly. This strongly increases the need.
  2. Regulation: Harbour is a bank, a regulated sector where risk management and control are scrutinised, and it is also listed. Corporate governance codes expect the board to review annually whether internal audit is needed and to explain if there is none.
  3. Risk: financial institutions face high risk from fraud, credit, and compliance failures. Independent review of controls is valuable.
  4. Cost-benefit: the cost is large in absolute terms, but small relative to the bank's size and the losses from control failure.
  5. Management attitude: the board's focus on cost suggests weak support for control, which is itself a concern.

Answer: The board's view is not reasonable. Size, geographic spread, regulation and risk make internal audit very likely to be needed, and the benefits outweigh the cost. Harbour should set up an internal audit function, reporting to the audit committee.

Exam tips

  • Always anchor each factor in a scenario fact. Generic lists score poorly.
  • Cover both sides when the case is borderline, then pick one conclusion.
  • Mention cost-benefit and outsourcing in any question about a small or mid-sized company.
  • In objective questions, sector and listing status are important clues, but weigh all the scenario facts, including size, complexity, risk and cost-benefit, before you choose an answer.
  • If asked about the audit committee or governance code, link internal audit to the board's duty to review controls.

Need for Internal Audit and Factors Affecting It in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Need for Internal Audit and Factors Affecting It: frequently asked questions

Is internal audit compulsory for companies?

For most companies it is not a legal requirement. Some regulated sectors, such as financial services, must have one, and listed companies are expected under governance codes to review annually whether they need one.

What factors should a company consider before setting up internal audit?

Consider scale, diversity and complexity of operations, number of employees, regulation, risk and control weaknesses, management attitude and cost-benefit. Link each to the company's circumstances.

Can a small company do without internal audit?

Yes, often. If operations are simple and management supervises closely, the cost may outweigh the benefit. Risk, regulation or growth could still change that.

How do I write this in a Section B answer?

State a factor, quote the scenario fact, explain the effect on the need, then conclude. Keep each point short and include cost-benefit.