Skip to content

Audit and Assurance · The scope of the internal audit function, outsourcing and internal audit assignments

Factors Affecting the Need for Internal Audit in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

A company needs an internal audit function when the benefits of independent assurance on risk, controls and governance outweigh the cost. Key factors are size, complexity, number of locations, risk, regulation, management attitude, and whether other monitoring already exists. Assess each factor against the scenario and conclude.

Understand Factors Affecting the Need for Internal Audit

Internal audit is an appraisal activity carried out within an entity, often as a service to it. It evaluates and reports on risk management, internal control and governance. It is not a legal requirement for most companies. So the question is always a judgement: does this entity need one?

Think of it as a cost-benefit decision. The cost is salaries, systems and management time. The benefit is better controls, earlier detection of fraud and error, and assurance to the board that its systems work. The more there is to control, the greater the benefit.

The main factors are:

  • Scale and diversity of operations: a large entity with many staff, sites or product lines cannot be watched directly by management.
  • Complexity: complex processes, IT systems, or transactions create more risk of error and fraud.
  • Number of employees: more staff means more need for formal control and monitoring.
  • Risk and cost-benefit: high-risk areas, such as cash handling or financial services, justify more review. The function must also be affordable.
  • Regulation and governance: listed companies under corporate governance codes are expected to review the need annually, and to explain if they have none. Some regulated sectors require one.
  • Management attitude: a board that values control and risk management is more likely to support and use internal audit. A weak or dominant management may not.
  • Other monitoring: strong management supervision, an active audit committee, or good external audit may reduce the need.
  • Changes: rapid growth, new systems, acquisitions, or past fraud and control failures increase the need.

In the exam you get a scenario. Use its facts to decide. A small owner-managed business with one site usually does not need a function. A growing multi-site group with weak controls usually does.

Key rules to remember

Cost-benefit test
Establish internal audit if benefits (better control, fraud deterrence, assurance) > costs (staff, systems, management time)
A judgement rule, not a calculation. Always conclude with it.
Main factors checklist
Size, complexity, number of locations and staff, risk, regulation and governance, management attitude, other monitoring, change
Use as a memory list. Pick only those the scenario supports.
Governance code expectation
Companies without internal audit should review the need annually and explain the decision
This reflects typical governance code practice for listed companies. Do not say it is a legal duty for all companies.

How to solve Factors Affecting the Need for Internal Audit questions

Use this method for any question asking whether an entity needs internal audit, or what to consider when setting one up.

  1. 1Read the requirement. Check whether you must discuss need, advantages and disadvantages, or whether to outsource.
  2. 2Underline facts in the scenario: size, locations, staff, systems, listing, sector, past problems, management style.
  3. 3Link each fact to a factor. Write the factor, then the fact, then the effect on need.
  4. 4Mark each factor as pointing to need or against need. Include both sides if the scenario gives them.
  5. 5Consider cost and alternatives, such as an audit committee, management review or outsourcing.
  6. 6Conclude clearly: needs one, does not need one, or should outsource. Justify in one sentence.
  7. 7Check you have enough distinct points for the marks available and that each is tied to the scenario.

Quickest way: Factor, fact, effect in one line each

When to use it: Use for short Section A or Section B questions, and when time is short in a written answer.

  1. Scan the scenario for the three or four strongest facts.
  2. For each, write a one-line point: factor, fact, effect.
  3. Add one cost or alternative point.
  4. Finish with a one-line conclusion.
  5. For objective questions, eliminate options that say internal audit is compulsory for all companies or that it replaces the external audit.

Common mistakes in Factors Affecting the Need for Internal Audit

  • Saying every company must have internal audit

    Students confuse internal audit with the statutory external audit.

    Fix: State that it is generally optional. Need depends on cost and benefit, apart from some regulated or governance code situations.

  • Listing factors without using the scenario

    Students memorise a list and write it out.

    Fix: Tie every factor to a fact, for example 'the group has twelve sites, so management cannot supervise directly'.

  • Ignoring cost

    Students focus on benefits only.

    Fix: Always mention that the function must be affordable and consider outsourcing or other monitoring as alternatives.

  • Giving no conclusion

    Students run out of time or think listing is enough.

    Fix: End with a clear recommendation and a brief reason.

  • Treating management attitude as only negative

    Students assume weak management means no need.

    Fix: Weak controls raise the need, but unsupportive management may limit effectiveness. Discuss both effects.

  • Confusing need for internal audit with its role

    Both topics sit in the same chapter.

    Fix: Answer the question set. For need, discuss why it is wanted. Do not list the work it performs unless asked.

Worked examples

Example 1

Bramble Ltd is a private company with one shop, eight employees and an owner-manager who personally supervises all cash and purchases. Discuss whether Bramble needs an internal audit function. (6 marks)

Show the solution
  1. Size and complexity: one shop and eight staff means operations are small and simple.
  2. Management supervision: the owner personally oversees cash and purchases, so direct monitoring already exists.
  3. Cost: a full-time internal auditor would be expensive compared with the business size and benefit.
  4. Regulation: Bramble is private, so no governance code pressure applies.
  5. Risk: cash handling is a risk, but the owner's supervision addresses it. Occasional external review could be bought in if needed.
  6. Conclude on the balance of these points.

Answer: Bramble does not need an internal audit function. Its small scale, simple operations and direct owner supervision mean the cost would exceed the benefit. If concerns arise, a periodic outsourced review is a cheaper alternative.

Example 2

Ridgeway plc is a listed group with 14 subsidiaries in six countries, 3,500 staff and a new group-wide ERP system. It has no internal audit function. A recent fraud in one subsidiary went undetected for a year. Explain the factors that suggest Ridgeway needs internal audit. (8 marks)

Show the solution
  1. Size and spread: 14 subsidiaries and six countries mean the board cannot monitor directly.
  2. Number of staff: 3,500 employees increases the risk of error and fraud and the need for formal control checks.
  3. Complexity and change: a new ERP system brings IT and data risks and needs review of controls.
  4. Past failure: the undetected fraud shows weaknesses in controls and monitoring.
  5. Governance: as a listed company, Ridgeway is expected under governance codes to review annually whether it needs internal audit and to explain if it has none.
  6. Cost: the group is large, so the cost is likely to be justified. Outsourcing is an option if skills are lacking.
  7. Conclude.

Answer: Ridgeway should establish an internal audit function, in-house or outsourced. Its scale, geographic spread, staff numbers, new systems, past fraud and listed status all increase the need, and the cost is small relative to the group.

Exam tips

  • Always use the scenario facts. A generic list earns few marks.
  • Give both sides where the scenario allows, then conclude.
  • Mention cost and alternatives such as outsourcing or an audit committee to show judgement.
  • In Section A or B objective questions, watch for absolute words like 'must' or 'always'. Internal audit is rarely compulsory for all entities.
  • Keep the answer separate from the role of internal audit unless the question asks for both.

Factors Affecting the Need for Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Factors Affecting the Need for Internal Audit: frequently asked questions

Is internal audit compulsory for companies?

For most companies it is not a legal requirement. Listed companies following a governance code are expected to review the need each year and explain if they have no function. Some regulated sectors may require one.

What factors affect whether a company needs internal audit?

Size, complexity, number of locations and staff, risk, regulation, management attitude, other monitoring and recent change. You should also weigh cost against benefit. Use the facts in the scenario for each factor.

How do I answer an internal audit need question in the exam?

Pick the key facts, link each to a factor and state the effect on need. Include cost and alternatives. Finish with a clear conclusion.

What are the disadvantages of having an internal audit function?

The main ones are cost, the time of management and staff, and a risk of reduced independence if the function reports to management. A poorly skilled or unsupported function may add little value.