Strategic Business Leader · Internal control and management reporting

Internal Audit Function and Role in ACCA SBL

Updated 11 October 2026 · Fact-checked

Internal audit is an independent, objective activity that evaluates and improves a company's governance, risk management and internal control. It reports to the audit committee, not to the managers it reviews. In SBL you decide whether a company needs one, then apply role, scope and independence to the scenario.

Understand Internal Audit Function and Role

Internal audit is a function inside (or contracted to) an organisation. Its job is to give management and the board assurance that risk management, control and governance processes work. It also gives advice to improve them. It is not a compliance police force and it is not there to prepare the financial statements.

The scope is set by the board and is wide. It can cover financial controls, operational efficiency, value for money, compliance with laws and policies, IT systems, fraud risk and the risk management process itself. Internal audit can also support special reviews, such as an acquisition or a new system. External audit, by contrast, gives an opinion on the financial statements for shareholders and is required by law for most companies.

Independence is what makes the work credible. Internal audit cannot be fully independent as it is part of the company. So you protect its objectivity. The head of internal audit should report functionally to the audit committee (made up of independent non-executive directors). Administrative reporting may go to the finance director or chief executive. The committee approves the audit plan, budget, appointment and removal of the head, and reviews findings. Internal audit should not design or run the controls it later audits.

Whether a company needs an internal audit function depends on the scenario. Listed companies in many governance codes must review annually whether one is needed, and must explain if they have none. Factors in favour are size, complexity, many locations, high risk, regulation, fraud history and weak controls. Factors against are small size, simple operations and the cost. Alternatives are outsourcing, co-sourcing or relying on management reviews.

In SBL you act as a professional adviser. Link every point to the facts in the case. Say what the function would do for this company, who it would report to and what could go wrong.

Key rules to remember

Core purpose of internal audit: Assurance + advice on governance, risk management and internal control; Use this to define the role in one line before applying it to the case.
Key reporting line: Head of internal audit → audit committee (functional); finance director or CEO (administrative); Functional reporting to independent NEDs protects objectivity.
Internal vs external audit: user: Internal = management and board; External = shareholders; Main contrast point. Also compare scope, appointment and legal requirement.
Need for internal audit: test: Need = scale + complexity + risk + regulation + weak control, against cost; A judgement, not a rule. Always weigh against cost and alternatives.

How to solve Internal Audit Function and Role questions

Use this method for any question on the role, independence or need for internal audit. Keep it tied to the scenario.

1Read the requirement and note the verb: explain, discuss, advise or recommend.
2Identify the company's size, structure, risks, locations and any control failures in the case.
3State the relevant role or principle in a line, such as assurance and advice on controls and risk.
4Apply it to the facts. Name the specific areas internal audit would review for this company.
5Deal with independence and reporting lines: audit committee, no involvement in running the areas audited, qualified staff.
6Weigh benefits against costs, and consider outsourcing or co-sourcing where relevant.
7Give a clear recommendation with a reason.
8Check the professional skills: concise, balanced, commercial and suited to the reader.

Quickest way: Role, Reporting, Reason

When to use it: Use when time is short or the requirement is a short discussion or recommendation.

Role: one line on what internal audit does and for whom.
Reporting: functional line to the audit committee and why it protects independence.
Reason: two or three case facts that support or oppose having a function.
Conclude with a firm recommendation and one risk or condition.

Common mistakes in Internal Audit Function and Role

Treating internal audit as the same as external audit.
Both use the word audit and both test controls.
Fix: State the differences: users, scope, appointment, legal requirement and opinion. Internal audit advises management; external audit reports on financial statements.
Saying internal audit is independent without explaining how.
Students recall the word but not the mechanisms.
Fix: Name the audit committee reporting line, approval of plan and head's removal, no operational duties and adequate resources.
Giving a generic answer on need that ignores the case.
Students list textbook factors from memory.
Fix: Pick the case facts: number of sites, past fraud, regulation, growth. Then reach a conclusion.
Saying a company must have an internal audit function.
Mixing up internal and statutory external audit.
Fix: Say it is usually a choice. Some codes require a listed company to review the need each year and explain if it has none.
Limiting the scope to financial controls.
Seeing audit as an accounting activity.
Fix: Include operational, compliance, value for money, IT, fraud and risk management reviews.
Listing points with no recommendation.
Running out of time or unsure of the verb.
Fix: End every advise-type answer with a clear decision and a reason.

Worked examples

Example 1

Rivaan Foods is an unlisted food processor with 12 sites in four countries. It has had two inventory frauds in three years. The board has no internal audit function and asks you to advise whether it should set one up and how to protect its independence. (10 marks style)

Show the solution

Role: internal audit would give the board assurance on controls, risk and governance, and advise on improvements.
Need: 12 sites in four countries make central oversight hard. Two frauds in three years show weak controls over inventory. Both point to a function.
Scope: stock counts and inventory controls, compliance with food safety law, operational efficiency, IT systems and the fraud risk process.
Cost: a team is costly. Outsourcing or co-sourcing could reduce cost and add expertise across countries.
Independence: the head should report functionally to an audit committee of non-executive directors, with administrative reporting to the finance director.
The committee should approve the plan, budget and any removal of the head. Staff should not take part in running the areas they audit.
Recommendation: set up the function, starting with inventory and fraud risk, and review after a year.

Answer: Rivaan Foods should establish internal audit, in-house or co-sourced, because of its multi-country spread and repeated frauds. It should report functionally to the audit committee to protect independence.

Example 2

A director of a small listed-style retailer with one shop says: 'Our external auditors already check everything, so internal audit is a waste of money.' Respond to this view. (8 marks style)

Show the solution

Correct the misunderstanding: external audit gives an opinion on the financial statements to shareholders. It is not designed to test all operations or advise management.
Internal audit has a different scope: operations, compliance, value for money, risk management and fraud prevention.
Internal audit works through the year. External audit focuses on the year-end financial statements.
Counter: with one shop, operations are simple and the owner can supervise directly. Cost may exceed benefit.
Alternatives: periodic management review, or buying internal audit services for specific reviews.
Conclusion: the director is wrong on the reason but may be right on the outcome. A full function is probably not needed, but some independent review of controls is.

Answer: External audit does not replace internal audit because the purposes and users differ. For a single small shop, though, a full internal function is probably not cost-effective. An outsourced review on key risks is a sensible compromise.

Exam tips

Always answer in the context of the company. Generic definitions earn few marks.
When asked about independence, name specific mechanisms: audit committee reporting, approval of plan and head's removal, adequate resources and no operational role.
For 'does it need one', give both sides and then commit to a recommendation.
Use a clear contrast format when comparing internal and external audit: users, scope, appointment, objective.
Keep professional skills in mind: a short, well-structured and balanced answer to the right reader scores better than a long list.

Practice questions from Internal control and management reporting

Internal Audit Function and Role in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function and Role: frequently asked questions

What is the main role of internal audit?

It provides independent assurance and advice on governance, risk management and internal control. It reports to the board through the audit committee. Its scope can include operations, compliance, value for money, IT and fraud.

What is the difference between internal and external audit?

External audit gives an opinion on the financial statements for shareholders and is usually a legal requirement. Internal audit serves management and the board, covers a wider scope and is set up by choice. The company appoints and directs the internal auditors; shareholders appoint external auditors.

Does a company need an internal audit function?

Not always. Larger, complex, high-risk or regulated companies usually benefit. Smaller, simple ones may rely on management review or outsource. Some governance codes ask listed companies to review the need each year and explain if there is none.

How does internal audit stay independent?

By reporting functionally to the audit committee of independent non-executive directors. The committee approves the plan and budget and the appointment or removal of the head. Internal auditors should not design or run the controls they review.