Audit and Assurance · Systems of internal control

Internal Audit Function and Monitoring of Controls in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

Internal audit is an appraisal function within an entity that evaluates and improves risk management, control and governance. It is not required by law for most companies. Its need depends on factors such as size, complexity and risk. To answer questions, state the role, test independence, and compare it with external audit.

Understand Internal Audit Function and Monitoring of Controls

Internal audit is a function set up by management or those charged with governance to review the entity's operations. It looks at risk management, internal control and governance. Its work is for the entity, so its scope is set by the entity and can be very wide.

The scope can include: reviewing the accounting and internal control systems, examining financial and operating information, reviewing economy, efficiency and effectiveness (value for money), checking compliance with laws and regulations, assisting with risk management, and reviewing the reliability of IT systems. It may also investigate suspected fraud.

Monitoring of controls is the process of assessing whether controls work as designed and over time. Management does this through ongoing activities, such as supervisory review and exception reports, and through separate evaluations. Internal audit is a common way of carrying out separate evaluations. Findings should be reported to the right level, and deficiencies should be followed up and fixed.

Independence matters because internal audit reviews management's own systems. Internal auditors are employees, so they are never independent in the way external auditors are. You achieve objectivity through safeguards. The head of internal audit should report to the audit committee or board, not to the finance director. The function should have unrestricted access to records and staff. It should not perform operational tasks it later audits. Staff should be rotated, and the audit committee should approve appointment, removal and budget.

The need for internal audit depends on: size of the business, complexity and diversity of operations, number of locations, risk and the cost versus benefit, the legal or regulatory requirements (for example listed company codes that require a review of the need), the attitude of management, and the quality of other controls. Where an entity is small, owner-managers can monitor controls directly, so a function is rarely justified. If there is no function, the external auditor will still need to look for other ways to monitor controls.

The external auditor can use internal audit work, but remains solely responsible for the opinion. This is why the topics are often examined together with the difference between internal and external audit.

Key rules to remember

Internal vs external audit: purpose: Internal: evaluate and improve risk management, control, governance. External: give an opinion on whether the financial statements are true and fair (or fairly presented).; Use this as the first line of any comparison answer.
Internal vs external audit: appointment and reporting: Internal: appointed by management or the board, reports to management or the audit committee. External: appointed by shareholders (members), reports to shareholders.; Reporting line is the key independence point.
Internal vs external audit: scope and focus: Internal: scope set by the entity, any area, mainly operations and controls. External: scope set by law and auditing standards, financial statements.; External auditor needs reasonable assurance only on material misstatement.
Internal vs external audit: relationship to the entity: Internal: employee or outsourced provider, not independent of the entity. External: independent of the entity.; Internal auditors aim for objectivity, not full independence.
Factors in need for internal audit: Scale, diversity and complexity of operations; number of employees and locations; risk; cost versus benefit; regulation; management attitude; quality of other controls.; Always link each factor to the scenario facts.
Independence safeguards: Reporting to audit committee or board; unrestricted access; no operational duties; audit committee controls appointment, removal and budget; rotation of staff.; Name the threat first, then the safeguard.

How to solve Internal Audit Function and Monitoring of Controls questions

Use this method for any question on the internal audit function, its need, its independence or monitoring of controls.

1Read the requirement verb. 'Explain' needs reasons, 'discuss' needs both sides, 'compare' needs matched points.
2Identify the type of question: need for a function, role and scope, independence, comparison with external audit, or monitoring of controls.
3Pull the scenario facts: size, number of sites, complexity, risks, who the function reports to, who is on the team, what other duties they have.
4Link each fact to a point. For example, many locations means management cannot monitor controls personally, so internal audit adds value.
5Give a balanced answer where asked. Include costs and the option of outsourcing or doing without a function.
6For independence, state each weakness and then a practical recommendation, such as changing the reporting line to the audit committee.
7Finish with a short conclusion or recommendation that answers the requirement. Keep each point to one clear sentence or two.

Quickest way: Fact-to-point matching

When to use it: Use this for Section B and C questions with a scenario and limited time.

Underline each fact in the scenario that relates to size, risk or reporting line.
Write a short label beside each, such as 'complexity', 'cost' or 'reports to FD'.
Turn each label into one point: fact, effect, conclusion.
For comparisons, write a two-column list in your head: purpose, appointment, reporting, scope, independence.
For objective tests, check the exact wording. Internal auditors are never independent of the entity, and the external auditor is never relieved of responsibility by using their work.

Common mistakes in Internal Audit Function and Monitoring of Controls

Saying internal audit is compulsory for all companies.
Students mix it up with the statutory external audit.
Fix: State that external audit is required by law for most companies but internal audit is generally a management or governance decision, unless a regulator or code requires it.
Describing internal auditors as independent in the same way as external auditors.
Both are called auditors and both talk about objectivity.
Fix: Say internal auditors are employees (or contractors), so they seek objectivity through safeguards such as reporting to the audit committee.
Listing generic points without using the scenario.
Students recall a memorised list under time pressure.
Fix: Use each listed factor only if a fact supports it and quote the fact.
Saying the external auditor can rely fully on internal audit and reduce responsibility.
Students overlook that the opinion belongs only to the external auditor.
Fix: State that the external auditor may use the work after assessing it but keeps full responsibility for the opinion.
Confusing monitoring of controls with control activities.
Both words sound like checking.
Fix: Control activities are the controls themselves, such as authorisation. Monitoring assesses whether those controls keep working over time.
Giving only the problem in an independence question.
Students stop after spotting the threat.
Fix: Add a recommendation each time, such as moving the reporting line to the audit committee.

Worked examples

Example 1

A retail company operates 40 stores across several countries and has no internal audit function. The finance director says it would cost too much. Discuss the need for an internal audit function.

Show the solution

Identify the facts: 40 stores, several countries, no function, cost concern.
Point for: many stores and countries mean the board cannot monitor controls directly, so internal audit can test whether store controls, such as cash handling and inventory counts, operate.
Point for: operations across countries create varied legal and risk environments, so compliance and risk reviews add value.
Point for: with no function, control deficiencies may go unnoticed, which raises the risk of fraud and error.
Point against: a function has a cost, including salaries and travel, which must be weighed against the benefit.
Alternative: the company could outsource the function or use a small team that focuses on the highest-risk stores.
Conclusion: the scale and spread of operations mean the benefits are likely to exceed the cost.

Answer: An internal audit function is justified. The number of stores and countries means management cannot monitor controls directly. The function would help to detect weaknesses, fraud and non-compliance. The cost concern can be managed by outsourcing or by a risk-based, smaller team.

Example 2

The head of internal audit at a listed company reports to the finance director. He also helped design the new payroll system and now plans to audit it. Identify the threats to objectivity and suggest safeguards.

Show the solution

Threat 1: reporting to the finance director means the function reviews the area of the person who controls its funding and promotion, so findings may be softened.
Safeguard 1: change the reporting line so the head of internal audit reports to the audit committee, which also approves appointment, removal and budget.
Threat 2: he helped design the payroll system, so he would be reviewing his own work (a self-review threat).
Safeguard 2: assign the payroll audit to a different member of the team or to an outside provider, and keep operational duties separate from audit work.
Further safeguard: give unrestricted access to records and staff, and rotate staff across areas over time.
Conclude that these measures improve objectivity, though internal auditors remain employees.

Answer: There is a threat from the reporting line to the finance director and a self-review threat from the payroll design. Safeguards are reporting to the audit committee, having someone else audit payroll, separating operational duties, giving unrestricted access, and rotating staff.

Exam tips

In comparison questions, use the same headings for both functions: purpose, appointment, reporting, scope and independence. Make a point for each side.
In Section B objective tests, watch absolute words such as 'always', 'only' and 'fully'. Most correct statements about internal audit are qualified.
In need questions, use only the factors supported by the scenario and say why each matters.
In independence questions, pair every threat with a specific safeguard and name who the function should report to.
If asked about monitoring, mention both ongoing activities by management and separate evaluations such as internal audit reviews, then say deficiencies must be reported and followed up.

Internal Audit Function and Monitoring of Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function and Monitoring of Controls: frequently asked questions

What is the main difference between internal and external audit?

Internal audit evaluates and improves risk management, control and governance for the entity. External audit gives an opinion on the financial statements to the shareholders. External auditors are independent of the entity, while internal auditors are not.

Does every company need an internal audit function?

No. Most companies are not legally required to have one, though some regulators or governance codes expect listed companies to review the need. The decision depends on factors such as size, complexity, risk and cost versus benefit.

How can internal audit be made objective?

The function should report to the audit committee or board, have unrestricted access to records and staff, and avoid operational duties it may later audit. The audit committee should control appointment, removal and budget. Rotation of staff also helps.

What does monitoring of controls mean in ACCA AA?

It is the process of assessing whether controls are working as intended over time. It includes ongoing management review and separate evaluations, often by internal audit. Deficiencies found should be reported and corrected.