Strategic Business Leader · Audit and compliance

Purpose and Role of Internal Audit in SBL

Updated 11 October 2026 · Fact-checked

Internal audit is an independent, objective assurance and consulting activity set up by the organisation to improve governance, risk management and control. It reports to the board or audit committee, not just to management. In SBL, you answer by linking its work to the scenario and showing the value it adds.

Understand Purpose and Role of Internal Audit

An organisation is run by managers, but owners and the board cannot watch everything. They need someone to check that risks are managed, controls work and rules are followed. Internal audit does this job from inside the organisation.

The usual definition describes internal audit as an independent and objective assurance and consulting activity designed to add value and improve operations. It helps the organisation reach its objectives through a systematic, disciplined approach to evaluating and improving governance, risk management and control processes.

The scope is set by the board or audit committee, not by the law in most cases. It can cover financial controls, operational efficiency, value for money, compliance with laws and policies, IT systems, fraud risk, and the risk management process itself. It is wider than the external audit, which looks at the financial statements.

Independence is what makes the work credible. Internal auditors are employees (or outsourced providers), so independence is relative, not absolute. It is protected by reporting lines. The head of internal audit should report functionally to the audit committee, have access to the board, and not be controlled by the managers being audited. Internal auditors should also not take on operating responsibilities for the areas they audit.

Internal audit supports governance by giving the board assurance and by checking compliance with codes and policies. It supports risk management by reviewing whether risks are identified and responded to. It supports control by testing controls and recommending improvements. Where there is no legal requirement, the board decides whether to have an internal audit function. Factors include size, complexity, risk, culture and cost.

Key rules to remember

Purpose of internal audit: Independent, objective assurance and consulting → adds value → improves governance, risk management and control; Use this as the opening line of any definition answer.
Three areas of focus: Governance + Risk management + Control; Link each point you make to one of these three areas.
Independence safeguards: Functional reporting to the audit committee + no operating duties + unrestricted access + audit committee involvement in appointment and removal of the head; Independence is a matter of degree. Say so in your answer.
Internal audit vs external audit (focus): Internal: scope set by the organisation, mainly for management and board, wide-ranging. External: scope set by law and standards, for shareholders, opinion on the financial statements.; A common comparison. Use purpose, reporting, scope and independence as headings.
Factors for having an internal audit function: Size + complexity + risk + culture + cost-benefit + regulatory demands + past failures; Use these when a scenario asks whether a company needs one.

How to solve Purpose and Role of Internal Audit questions

Use this method for any SBL requirement on the role, scope, independence or value of internal audit.

1Read the requirement and note the verb: assess, explain, evaluate, advise, or compare. It decides how much analysis you need.
2Identify who you are writing for, such as the board, audit committee or chair, and match the tone and format (report, memo, briefing).
3Pull out the scenario facts: size, structure, risks, past problems, current controls, whether a function exists, and who it reports to.
4Link each point to governance, risk management or control, and to the organisation's own objectives.
5Apply the theory to the facts. Say what the scenario shows, why it matters and what the board should do.
6Deal with independence and objectivity where relevant: reporting lines, resourcing, access, and any self-review or familiarity threats.
7Give a reasoned recommendation, and note limits such as cost, management resistance or skills gaps.
8Finish with a clear conclusion that answers the requirement, and check you earned professional skills marks through analysis, scepticism and commercial awareness.

Quickest way: Purpose, Scope, Independence, Value (PSIV)

When to use it: When time is short and you need a fast, structured plan for any internal audit question.

P: state the purpose in one line (independent assurance and advice on governance, risk and control).
S: list the scope relevant to the scenario, such as operations, compliance, IT, fraud, value for money.
I: comment on independence, covering reporting line, access and conflicts.
V: show value added using scenario facts, such as fewer control failures, better risk awareness, savings or stronger board confidence.
Add one balanced point on limitations or cost, then a recommendation.

Common mistakes in Purpose and Role of Internal Audit

Describing internal audit as only checking the accounts.
Students confuse it with external audit, which gives an opinion on the financial statements.
Fix: State that internal audit covers governance, risk, control, operations and compliance, and that its scope is set by the organisation.
Claiming internal auditors are fully independent.
Independence is learned as a rule, and the employee status is overlooked.
Fix: Say independence is relative. Explain the safeguards: reporting to the audit committee, no operating role, and unrestricted access.
Listing textbook differences between internal and external audit with no link to the scenario.
Students memorise tables and reproduce them.
Fix: Choose only the differences that matter to the company and explain what they mean for the board's decision.
Saying internal audit is responsible for designing and running controls.
Students mix up assurance with management's responsibility.
Fix: Management owns risk and control. Internal audit evaluates and advises. If it designs controls, objectivity is weakened.
Recommending an internal audit function without weighing cost and alternatives.
Students assume more assurance is always better.
Fix: Weigh benefits against cost, and consider outsourcing, co-sourcing or a smaller in-house team.
Giving a generic answer with no professional skills.
Students focus on theory and forget the 20 professional skills marks in SBL.
Fix: Use the scenario, challenge assumptions, give a clear recommendation, and write in the format requested.

Worked examples

Example 1

You are an adviser to the board of Kestrel Retail, a listed chain with 120 stores that has no internal audit function. After several stock losses and a supplier fraud, the chair asks you to explain what internal audit would do for the company and whether it should be set up. (10 marks)

Show the solution

Define: an independent, objective assurance and consulting activity that evaluates and improves governance, risk management and control.
Link to scenario: stock losses and the supplier fraud point to weak controls over stores and purchasing. Internal audit could test stock counts, supplier set-up and payment authorisation.
Scope: operational reviews of stores, compliance with company policy, fraud risk review, and review of whether management identifies and responds to risks.
Governance: it would give the board independent assurance rather than relying on reports from the managers being monitored.
Independence: the head should report to the audit committee, have access to the chair, and not run store operations.
Value added: earlier detection of losses, better controls, and more confidence for shareholders and lenders.
Cost and alternatives: a function for 120 stores is likely to be justified given size, dispersed operations and recent failures. Outsourcing or co-sourcing could be used first to limit cost and fill skills gaps.
Conclusion: set up the function, with a reporting line to the audit committee and a risk-based plan covering stock and purchasing first.

Answer: Internal audit would provide independent assurance and advice on governance, risk and control, directly targeting the stock and fraud problems. Given the company's size, spread and recent failures, the board should establish it, reporting to the audit committee, possibly starting with outsourcing or co-sourcing to manage cost.

Example 2

The audit committee of Delmar Foods asks you to compare its internal audit with the external audit, and to say how the internal audit can stay objective when the head of internal audit reports to the finance director. (10 marks)

Show the solution

Purpose: external audit gives an opinion on whether the financial statements give a true and fair view. Internal audit gives assurance and advice on governance, risk and control to improve operations.
Reporting: external auditors report to shareholders. Internal audit reports to the board or audit committee and management.
Scope: external audit scope is set by law and auditing standards. Internal audit scope is set by the organisation and can include operations, compliance, IT and fraud risk.
Appointment: external auditors are appointed by shareholders. The organisation appoints internal auditors, who may be employees or outsourced.
Independence: external auditors are independent of the company. Internal auditors are part of the organisation, so independence is relative.
Problem in scenario: reporting to the finance director means that the person responsible for finance controls could influence or limit reviews of the finance function. This is a threat to objectivity.
Fix: change the functional reporting line to the audit committee, with administrative reporting only to a senior executive. Give the committee a say in appointing, assessing and removing the head. Ensure unrestricted access to records and people, and keep internal auditors out of operational duties.
Conclusion: the two audits have different purposes and complement each other, but the reporting line needs to be changed to protect objectivity.

Answer: External audit gives a legally required opinion on the financial statements for shareholders. Internal audit is an organisation-driven review of governance, risk and control for the board and management. To protect objectivity, the head of internal audit should report functionally to the audit committee rather than to the finance director.

Exam tips

Always tie purpose and scope to scenario facts. A textbook definition alone earns few marks.
When comparing internal and external audit, choose the points that matter to the decision in the scenario instead of listing everything.
Treat independence as a matter of degree. Name the threat and the safeguard.
Use the requested format and address the named reader, as this earns professional skills marks.
Show balance: benefits, cost, and limits such as management resistance or skills gaps, then a clear recommendation.

Practice questions from Audit and compliance

Purpose and Role of Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Purpose and Role of Internal Audit: frequently asked questions

What is the main purpose of internal audit?

Its main purpose is to give independent and objective assurance and advice that improves governance, risk management and control. It helps the organisation meet its objectives. It adds value by finding weaknesses and recommending practical improvements.

What is the difference between internal audit and external audit?

External audit is usually required by law and gives an opinion on the financial statements for shareholders. Internal audit is chosen by the organisation, has a wider scope set by the board, and mainly serves management and the board. Internal auditors are part of or contracted to the organisation, so their independence is relative.

How does internal audit add value to an organisation?

It identifies control weaknesses, inefficiencies and compliance gaps before they cause loss. It gives the board assurance that risks are being managed and recommends improvements. It can also support fraud prevention and help management make better decisions.

How can internal audit stay independent?

Its head should report functionally to the audit committee and have access to the board. The function should not run the operations it audits, and it needs unrestricted access to records. The audit committee should be involved in appointing, assessing and removing the head.

Does every company need an internal audit function?

No. In many cases it is a board decision, though some regulated sectors or listing rules may require one. Factors include size, complexity, risk, culture and cost against benefit. Where there is no function, listed companies are often expected to review the need regularly.