Audit and Assurance · The scope of the internal audit function, outsourcing and internal audit assignments

Internal Audit Independence, Reporting and Evaluation

Updated 11 October 2026 · Fact-checked

Internal audit independence means the function can report objectively without pressure from the managers it reviews. It is protected by reporting to the audit committee. Under ISA 610, the external auditor evaluates objectivity, competence and a systematic approach before deciding whether, and how far, to use the internal auditors' work.

Understand Internal Audit Independence, Reporting and Evaluation

Internal audit is a function set up by management or those charged with governance to evaluate and improve risk management, control and governance. It is not required by law for most companies. So its value depends on whether the board and others can trust what it says.

Trust depends on independence and objectivity. Internal auditors are usually employees, so they can never be fully independent like the external auditor. The aim is to reduce threats: pressure from the finance director, reviewing their own work, or fear for their pay and promotion. The key protection is the reporting line. The head of internal audit should report to the audit committee (made up of non-executive directors), not to the finance director. The committee should approve the appointment, removal, pay and budget of the head of internal audit, agree the audit plan, and receive reports directly. The head should have access to the committee chair without management present.

Other safeguards include: no operational duties for internal auditors in areas they audit; rotating staff between areas; a clear charter setting out scope and authority; unrestricted access to records and staff; adequate resources; and a requirement for management to respond to findings and for follow-up to be tracked.

The external auditor may want to use internal audit's work to reduce their own work. ISA 610 (Revised 2013) deals with this. The external auditor is solely responsible for the audit opinion, and using internal audit does not reduce that responsibility. First, they evaluate the function: its objectivity (status in the organisation, reporting lines, conflicts), its competence (qualifications, training, experience) and whether it applies a systematic and disciplined approach (planning, supervision, review, documentation, quality control).

If the function passes, the external auditor then decides which work can be used, considering the area's risk and judgement involved. They must test that work, for example by re-performing some of it, and evaluate whether the conclusions are appropriate. Higher risk and more judgement mean less reliance. The external auditor can never hand over judgemental areas such as significant risks entirely.

Key rules to remember

Evaluation criteria for reliance: Objectivity + Competence + Systematic and disciplined approach; If any of the three is weak, reliance is limited or ruled out. Always address all three.
Reporting line principle: Head of internal audit → audit committee (functionally); management (administratively); Functional reporting to the committee protects independence. If no audit committee exists, the board or a non-executive director is the alternative.
ISA 610 reliance steps: Evaluate function → decide extent of use → discuss and agree with internal audit → test the work; The external auditor keeps sole responsibility for the opinion.
Level of reliance guide: Higher risk and higher judgement → less reliance; lower risk and less judgement → more reliance; This is a guide to apply to the scenario, not a fixed rule.
Direct assistance: Internal auditors may help under the external auditor's direction, supervision and review; Not allowed where the work involves significant judgement or high risk; applies only where law allows it.

How to solve Internal Audit Independence, Reporting and Evaluation questions

Use this method for any question about independence, reporting or reliance on internal audit.

1Read the requirement and identify the task: independence threats, reporting lines, evaluating the function, or deciding what work to rely on.
2Pick out the scenario facts: who internal audit reports to, who sets pay and plan, staff skills, past duties, resources, and documentation.
3For independence, list each threat found in the scenario and pair it with a specific safeguard, such as reporting to the audit committee.
4For evaluation, structure the answer under objectivity, competence and systematic approach. Give one scenario fact per heading and say if it is a strength or weakness.
5For reliance, link to risk and judgement. Say which areas could be relied on and which require the external auditor's own work.
6State the testing the external auditor must perform on the work used, such as re-performance or reviewing working papers.
7Conclude: the external auditor retains sole responsibility for the opinion, then give a clear recommendation.

Quickest way: The O-C-S check with risk filter

When to use it: Use this under time pressure for any written or objective question on relying on internal audit.

Write O, C, S on your page for objectivity, competence and systematic approach.
Tick or cross each one using the scenario facts. A reporting line to the finance director is a cross for O.
Add the risk filter: is the area high risk or judgemental? If yes, limit reliance.
Add one test: re-perform or review the work before using it.
Close with: the external auditor remains responsible for the opinion.

Common mistakes in Internal Audit Independence, Reporting and Evaluation

Saying internal auditors are fully independent of the company.
Students mix up internal audit with the external auditor's independence.
Fix: Say internal audit is part of the organisation, so independence is relative. Focus on objectivity and the safeguards that protect it.
Recommending that internal audit report to the finance director.
It seems natural because internal audit often reviews finance, and the FD is senior.
Fix: The finance director runs the area being reviewed. Recommend functional reporting to the audit committee.
Stating that the external auditor can rely fully on internal audit and reduce responsibility.
Students think reliance transfers responsibility.
Fix: State clearly that the external auditor has sole responsibility for the opinion and must test the work used.
Listing only competence when asked to evaluate internal audit.
Staff qualifications are the easiest facts to spot.
Fix: Always use all three headings: objectivity, competence and systematic approach. Each carries marks.
Giving general points about the need for internal audit instead of answering the question.
Students recall the broader chapter and write all they know.
Fix: Match the requirement. If it asks about reliance, use ISA 610 points, not the benefits of internal audit.
Forgetting to say what the external auditor does with the work.
Students stop once they conclude the function is acceptable.
Fix: Add the testing step: re-perform a sample, review working papers and check conclusions are appropriate.

Worked examples

Example 1

Bellmont Co has an internal audit department of four staff. The head of internal audit reports to the finance director, who sets the department's budget and approves its annual plan. Two internal auditors were recently moved from the accounts payable team and now review that area. Suggest how independence could be improved.

Show the solution

Identify the threats: reporting to and being funded by the finance director, and self-review by staff reviewing their former area.
Reporting line: the head of internal audit should report to the audit committee, which should approve the plan, budget, appointment and removal.
Self-review: the two auditors should not review accounts payable for a suitable period, and should be assigned elsewhere.
Add that the head should have direct access to the committee chair, and a charter should set out scope and authority.
Add that management must respond to reports and follow-up should be monitored.

Answer: Independence improves by moving reporting to the audit committee, giving it control over plan, budget and appointment, and removing the auditors from reviewing their former accounts payable area. A charter and direct access to the committee chair add further protection.

Example 2

You are the external audit senior on Corvid Co. You plan to use internal audit's work on inventory controls at warehouses. Internal audit staff are professionally qualified, report to the audit committee, and use documented work programmes reviewed by the head. Inventory is a significant risk for the audit. Discuss whether and how you could rely on the work.

Show the solution

Objectivity: reporting to the audit committee supports it. This is a strength.
Competence: staff are professionally qualified. This is a strength, though you would also consider training and experience.
Systematic approach: documented work programmes with review by the head indicate a disciplined approach.
Conclusion on the function: it appears suitable for reliance.
Risk filter: inventory is a significant risk, so judgement is higher and reliance should be limited.
Testing: re-perform some of the inventory control tests and review the working papers to check conclusions are appropriate.
Responsibility: carry out your own procedures on inventory existence and valuation.

Answer: The function appears objective, competent and systematic, so some of its work on inventory controls can be used. Because inventory is a significant risk, reliance should be limited, the work must be tested by re-performance and review, and you must perform your own procedures. You keep sole responsibility for the opinion.

Exam tips

Structure evaluation answers under objectivity, competence and systematic approach, and use scenario facts under each heading.
Always link the extent of reliance to risk and judgement. Significant risks need your own work.
When a scenario shows a reporting line to management, expect the model answer to suggest the audit committee as the fix.
Use ISA 610 language, such as systematic and disciplined approach, and state that the external auditor has sole responsibility.
In objective test cases, be ready for questions on who internal audit should report to and which factor is not part of the evaluation.

Internal Audit Independence, Reporting and Evaluation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Independence, Reporting and Evaluation: frequently asked questions

Who should the head of internal audit report to?

The head should report functionally to the audit committee, which is made up of non-executive directors. Administrative reporting to a senior executive can exist for day-to-day matters. Reporting to the finance director on functional matters is a threat to objectivity.

What does ISA 610 require before using internal audit's work?

The external auditor must evaluate the function's objectivity, competence and whether it applies a systematic and disciplined approach. If suitable, they decide what work to use and test it. Responsibility for the opinion stays with the external auditor.

Can internal auditors help the external auditor directly?

Where law and regulation allow it, internal auditors may give direct assistance under the external auditor's direction, supervision and review. This is not suitable for work with significant judgement or high risk. The external auditor must also assess threats to objectivity and the internal auditors' competence.

Why can internal audit never be fully independent?

Internal auditors are usually employees, so management pays them and may influence their careers. Safeguards such as audit committee oversight reduce this, but do not remove it. This is why the external auditor evaluates objectivity before relying on their work.