Audit and Assurance · The use and evaluation of systems of internal control by auditors

Internal Audit and Governance Aspects of Control

Updated 11 October 2026 · Fact-checked

Internal audit is a function set up by management to evaluate and improve risk management, control and governance. It reports to management or the audit committee. The external auditor may use its work under ISA 610 only after assessing objectivity, competence and quality of work, and must keep sole responsibility for the opinion.

Understand Internal Audit and Governance Aspects of Control

Internal audit is an appraisal activity within the entity. Management or those charged with governance decide its scope. It may review controls, risk management, compliance, efficiency and value for money. It can be in-house or outsourced.

Internal audit is part of the monitoring of controls component. It tests whether controls are designed well and working, reports weaknesses, and follows up whether management fixed them. This is why the external auditor looks at it when understanding the entity's internal control.

The audit committee is a board committee of independent non-executive directors. It oversees financial reporting, internal control, risk management and the external audit. It should approve the appointment and removal of the head of internal audit, review the internal audit plan and receive its reports. This gives internal audit independence from executive management. Where there is no internal audit function, the committee should consider each year whether one is needed.

The external auditor gives an opinion on the financial statements for shareholders. Internal audit serves management. Their objectives, reporting lines and independence differ. Their work overlaps on controls, so the external auditor may use internal audit's work. Under ISA 610 the external auditor must first decide whether internal audit's work is likely to be adequate for audit purposes. The auditor stays solely responsible for the opinion. The auditor should not refer to internal audit's work in the audit report, unless law or regulation requires it. Even where such a reference is required, it does not reduce the auditor's responsibility for the opinion.

The need for internal audit depends on factors such as the size and complexity of the entity, the number of locations, the volume of transactions, risk and regulatory requirements, the quality of management and control, and cost against benefit.

Key rules to remember

External auditor's assessment of internal audit (ISA 610): Reliance depends on: objectivity + technical competence + a systematic and disciplined approach (due professional care, including quality control); Use these three factors as your checklist. Communication with the external auditor is a practical consideration, not a separate ISA 610 test.
Responsibility rule: External auditor's responsibility for the opinion = sole; not reduced by use of internal audit; Never say reliance shifts responsibility to internal audit. Do not refer to internal audit's work in the audit report unless law or regulation requires it. Even then, the reference does not reduce the auditor's responsibility.
Direct assistance: Direct assistance is allowed only if law permits and the internal auditors are objective and competent, and the work is directed, supervised and reviewed by the external auditor; Direct assistance is internal auditors performing audit procedures under the external auditor's supervision. Do not assign procedures that involve significant judgement, or that relate to higher assessed risks of material misstatement where more than limited judgement is needed. For other work, limit what is assigned according to the judgement involved and the assessed risk.
Reliance judgement: Higher risk or more judgement = less reliance and more own work; Use internal audit more for low-risk areas such as routine controls. Do not use it for key judgements such as estimates.

How to solve Internal Audit and Governance Aspects of Control questions

Use this method for any question on internal audit, the audit committee or reliance.

1Read the requirement. Decide whether it asks for the role of internal audit, a comparison with external audit, factors for the need for internal audit, or reliance and evaluation.
2Identify the scenario facts: size, reporting line, staffing, qualifications, past work, areas covered.
3For reliance questions, apply the three ISA 610 factors: objectivity, technical competence, and a systematic and disciplined approach (due professional care, including quality control). Link each to a scenario fact. You can also comment on communication between internal audit and the external auditor.
4Decide the effect. Consider the nature, timing and extent of external audit procedures, and whether the work relates to high-risk areas.
5State the safeguards: evaluate the work, test a sample of it, re-perform some, and keep sole responsibility.
6For governance points, link to the audit committee: oversight, independence of the head of internal audit, and review of the plan and reports.
7Give a clear conclusion or recommendation and match the number of points to the marks.

Quickest way: Three-factor reliance checklist

When to use it: Use in objective test questions and in short written requirements on whether the external auditor can use internal audit's work.

Write O, C, S on your scratch pad: objectivity, competence, systematic and disciplined approach (due care and quality control).
Mark each as met, weak or unknown from the scenario.
If objectivity is weak, such as reporting only to the finance director, think limited reliance and recommend the audit committee.
Remember the opinion stays with the external auditor, so reject any option that says responsibility transfers.
Prefer options that say the auditor evaluates and tests the work, rather than accepting it unchecked.

Common mistakes in Internal Audit and Governance Aspects of Control

Saying the external auditor can pass responsibility to internal audit when relying on its work.
Students think reliance is like delegation to an expert team.
Fix: State that responsibility for the opinion is sole and is not reduced by using internal audit. Say the use should not be mentioned in the audit report unless law or regulation requires it, and even then responsibility is not reduced.
Listing differences between internal and external audit without applying them to the scenario.
Students recall a memorised table.
Fix: Pick differences that matter for the question, such as objective, reporting line and independence, and tie each to the scenario facts.
Assuming internal audit is never independent.
Internal auditors are employees, so students dismiss them.
Fix: Say independence is a matter of degree. It improves if the head reports to the audit committee, so assess the reporting line and whether staff audit areas they operate.
Using internal audit work for high-risk judgemental areas.
Students think more reliance is always more efficient.
Fix: Limit reliance where risk is high or judgement is significant. Use it for low-risk areas and do your own work on key estimates.
Confusing the audit committee with internal audit.
Both deal with control and both report to the board.
Fix: The audit committee is a board committee that oversees. Internal audit is a function that performs reviews. The committee oversees and receives reports from internal audit.
Giving only a generic list of internal audit roles.
Students do not read the scenario for the specific need.
Fix: Tie the role to the entity: for example, many locations support a need for internal audit and a small owner-managed entity may not need one.

Worked examples

Example 1

Section B style. Rowan Co has an internal audit team of four staff, all qualified accountants. The head of internal audit reports to the finance director, who also selects the areas to be reviewed. Last year the team reviewed the payroll and purchases controls and issued reports. The external auditor wishes to rely on this work. Discuss whether reliance is appropriate.

Show the solution

Objectivity: the head reports to the finance director, who chooses the areas. This weakens independence because the finance director is responsible for the controls reviewed. Reliance is therefore limited unless this is mitigated.
Competence: staff are qualified accountants, which supports technical competence. The auditor should still check experience and training in audit work.
Systematic and disciplined approach (due professional care): check whether work is planned, supervised, reviewed and documented, and whether it follows a recognised approach with quality control.
Communication: this is a practical consideration rather than a separate ISA 610 test. The external auditor should discuss scope and findings with internal audit and read its reports.
Effect: payroll and purchases are routine areas, so some reliance on control testing is possible after the auditor re-performs a sample of the work.
Responsibility: the auditor keeps sole responsibility for the opinion and should not refer to internal audit in the audit report, unless law or regulation requires it. Even then, responsibility is not reduced.
Recommendation: suggest that the head of internal audit report to the audit committee to improve independence.

Answer: Limited reliance is possible. Competence is supported, but objectivity is weakened by the finance director's control of reporting and scope. The auditor should evaluate and re-perform a sample of the payroll and purchases work, use it for lower-risk areas only, and keep sole responsibility for the opinion.

Example 2

Section C style. List the differences between internal audit and external audit, and explain how the audit committee supports the independence of internal audit. (6 marks)

Show the solution

Objective: internal audit evaluates and improves risk management, control and governance as management requires. External audit gives an opinion on whether the financial statements give a true and fair view.
Appointment: management or the board appoints internal auditors, who are usually employees or an outsourced firm. Shareholders appoint the external auditor.
Reporting: internal audit reports to management or the audit committee. External audit reports to shareholders.
Scope: management sets internal audit's scope, which can include efficiency and compliance. The scope of external audit is set by law and auditing standards.
Independence: external auditors must be independent of the entity. Internal auditors are part of the entity, so their independence depends on the reporting line.
Audit committee: it reviews and recommends the appointment and removal of the head of internal audit, reviews the plan and reports, and reviews the function's resources and access to the board.
Result: the head reports to the committee rather than to executives, which reduces pressure and improves objectivity.

Answer: Internal audit serves management, has a scope set by management and covers controls and operations. External audit serves shareholders, has a legally set scope and gives an opinion on the financial statements. The audit committee supports internal audit independence by reviewing and recommending the head's appointment and removal, reviewing plans, reports and resources, and receiving direct reporting.

Exam tips

In reliance questions, name all three ISA 610 factors and link each to a fact. Marks come from the application, not the list.
Always say the external auditor keeps sole responsibility for the opinion. Examiners look for it.
If the scenario gives a reporting line to a finance director, point out the threat to objectivity and recommend reporting to the audit committee.
For a compare question, choose differences relevant to the scenario, such as objective, reporting line and independence, and use short sentences.
In objective tests, reject options that say responsibility is shared or that the work can be used with no evaluation.

Internal Audit and Governance Aspects of Control in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit and Governance Aspects of Control: frequently asked questions

What is the main difference between internal audit and external audit?

Internal audit is set up by management to evaluate and improve control, risk management and governance. External audit gives an independent opinion on the financial statements for shareholders. Their objectives, reporting lines and independence differ.

Can the external auditor rely on internal audit under ISA 610?

Yes, in some cases. The auditor must first assess the objectivity, competence and quality of the internal audit function and whether its work is adequate for the audit. The auditor still has sole responsibility for the opinion.

What is the role of internal audit in internal control?

Internal audit forms part of the monitoring of controls. It reviews whether controls are designed well and operate properly, reports weaknesses to management or the audit committee, and follows up on action taken.

How does the audit committee relate to internal control?

The audit committee oversees financial reporting, internal control and risk management. It reviews internal audit's plan and reports and helps protect internal audit's independence. It also oversees the relationship with the external auditor.