Strategic Business Leader · Management and internal control systems

Internal Audit Function and Its Role in ACCA Strategic Business Leader

Updated 11 October 2026 · Fact-checked

Internal audit is an independent, objective assurance and consulting activity inside an organisation. It reviews risk management, internal control and governance, and reports to management and the audit committee. To answer SBL questions, state the role, test independence and reporting lines, then apply them to the scenario's facts.

Understand Internal Audit Function and Its Role

Internal audit is a function set up by the organisation to examine its own operations. Its job is to give the board assurance that risks are managed and controls work. It can also advise management on improvements. It is not responsible for running the controls. Management owns controls and risk. Internal audit checks them.

The scope is set by the board, usually through the audit committee, and is wide. It can cover financial controls, operational efficiency, value for money, compliance with laws and policies, IT systems, fraud risk and the risk management process itself. Internal audit also reviews how reliable management information is. Scope is not limited to the financial statements, which is a key contrast with external audit.

Independence is what makes the work credible. Internal auditors are employees or an outsourced provider, so they are never fully independent. You protect objectivity through structure. The head of internal audit should report functionally to the audit committee, with an administrative line to a senior executive such as the CEO. They should have unrestricted access to records, staff and the committee chair. Their appointment, removal and pay should be agreed by the audit committee. They should not audit areas they used to run or take on management duties.

The function can be in-house or outsourced. In-house gives deep knowledge of the business and quick response. Outsourcing gives specialist skills, flexibility and perhaps lower cost, but weaker business knowledge and possible confidentiality risks. A firm may also co-source, mixing both. Some organisations have no internal audit. Then the board should consider annually whether one is needed, looking at size, complexity, risk and the cost.

In the exam, the common requirements are to explain the role, assess a weakness in the function, recommend improvements, or compare internal and external audit. Always link points to the case facts and to the board's responsibility for risk and control.

Key rules to remember

Internal audit core purpose: Internal audit = independent assurance + advice on risk management, control and governance; Use this as your opening definition. It is reported to the board or audit committee, not just to management.
Reporting line rule: Functional reporting → audit committee; administrative reporting → senior executive; Strong independence needs the audit committee to approve the plan, budget, and appointment or removal of the head of internal audit.
Internal vs external audit: who and why: Internal: appointed by management/board, scope set by the organisation, reports on controls and risk. External: appointed by shareholders, scope set by law and standards, reports on the financial statements; Both are needed. They differ in purpose, reporting, scope and independence, not in quality.
Need-for-internal-audit factors: Scale + diversity/complexity + risk + cost-benefit + staff issues + problems with controls; Use as a checklist when asked whether a company without internal audit should create one.

How to solve Internal Audit Function and Its Role questions

Use this method for any internal audit question in SBL. It keeps you on the requirement and earns professional skills marks.

1Read the requirement and circle the verb: explain, assess, recommend, compare or advise. Note who you are writing to, such as the audit committee or the board.
2Scan the scenario for facts: size, structure, risks, past control failures, who internal audit reports to, and who runs it.
3Define the role briefly in one or two lines: assurance and advice on risk, control and governance.
4Apply the points to the case. For independence, test the reporting line, access, appointment, pay, and any conflicts of interest.
5Weigh the options if the question asks for a choice, such as in-house versus outsourced. Give pros and cons tied to the facts.
6Make clear recommendations: who should report to whom, what scope to add, what skills are needed.
7Write in the requested format, such as a memo or report, with a short conclusion. Show scepticism and commercial sense.

Quickest way: Role, Independence, Scope: RIS check

When to use it: Use when time is short or you need a fast structure for a 10 to 15 mark requirement on internal audit.

R: state the Role in one line, assurance and advice on risk, control and governance.
I: test Independence using four checks: reporting line, access, appointment and pay, and conflicts.
S: check Scope against the case. Is it too narrow, such as financial only, or missing key risks?
Add one clear recommendation per weakness you find.
Close with the benefit to the board: better assurance and better governance.

Common mistakes in Internal Audit Function and Its Role

Treating internal audit as the same as external audit.
Both are called audit and both test controls, so students blur them in the case.
Fix: Contrast purpose, appointment, scope, reporting and independence. External audit gives an opinion on the financial statements. Internal audit gives assurance on risk and control.
Saying internal audit is responsible for internal controls.
The name sounds like it owns the controls.
Fix: State that management designs and operates controls and the board is responsible for the system. Internal audit reviews and reports on them.
Claiming internal auditors are fully independent.
Students learn independence as a requirement and forget employees have limits.
Fix: Say independence is protected by structure, such as reporting to the audit committee. Then identify the risks to it in the case.
Listing generic points with no link to the scenario.
Students memorise textbook lists and skip the case facts.
Fix: Quote a case fact in each point, such as the head of audit reporting to the finance director. Then explain the effect and recommend a change.
Recommending outsourcing or in-house without weighing both.
Students pick the answer they think the examiner wants.
Fix: Give advantages and disadvantages of each, tie them to the company's size, risks and skills, and then reach a reasoned conclusion.
Limiting scope to financial controls.
Students assume audit is about accounts.
Fix: Include operations, value for money, compliance, IT, fraud risk and the risk management process.

Worked examples

Example 1

Sundara Foods plc has an internal audit team of four. The head of internal audit reports to the finance director (FD), who sets the team's budget and annual plan. The team recently reviewed the finance department's payables process and reported no issues. The audit committee has not met the head of internal audit in the last year. Assess the independence of the internal audit function and recommend improvements. (10 marks)

Show the solution

Define the issue: independence means auditors can report objectively without pressure. It is protected through reporting lines, resources and freedom from conflicts.
Reporting line: the head of internal audit reports to the FD. The FD runs finance, which internal audit reviews. This is a self-review risk and a threat to objectivity.
Resources and plan: the FD controls budget and plan. The FD could limit the scope or cut resources for areas that expose finance weaknesses.
Evidence from the case: the payables review found no issues. This may be fine, but it cannot be relied on as independent assurance given the structure. Note this with scepticism, not as proof of poor work.
Audit committee: no contact in the last year means the committee does not have direct assurance or a way to hear concerns. This weakens governance.
Recommendation 1: make the head of internal audit report functionally to the audit committee, with an administrative line to the CEO.
Recommendation 2: the audit committee should approve the plan, budget, and the appointment, pay and removal of the head of internal audit.
Recommendation 3: arrange regular meetings, including some without management present, and give unrestricted access to records and staff.
Conclusion: these steps would raise confidence of the board and shareholders in the assurance provided.

Answer: Independence is currently weak. The head of internal audit reports to the FD, who controls the budget and plan and whose department is audited. The audit committee has no regular contact. Recommend functional reporting to the audit committee, committee approval of plan, budget and appointment, and regular private meetings with unrestricted access.

Example 2

Karan Retail Ltd, a growing company with 60 stores, has no internal audit. The board is considering either an in-house team or outsourcing to an audit firm. The company has had stock losses and inconsistent store procedures. Advise the board. (12 marks)

Show the solution

Start with need: 60 stores, stock losses and inconsistent procedures show weak control and rising risk. An internal audit function is justified on scale, risk and control problems.
Scope to give: store controls and stock, compliance with procedures, fraud risk, cash handling, IT systems and value for money.
In-house advantages: deep knowledge of the business, continuous presence, quick follow-up, and staff can build a career path.
In-house disadvantages: cost of recruiting and training, risk of limited skills such as IT or fraud work, and weaker independence if staff are close to store managers.
Outsourcing advantages: access to specialist skills, flexibility to scale up for store visits, and a more independent view.
Outsourcing disadvantages: less business knowledge, higher cost per day, confidentiality risk, and reliance on the provider. The firm should not be the external auditor, as this threatens independence.
Recommendation: start with outsourcing or co-sourcing to deliver quickly and bring specialist skills, while building a small in-house team that reports to the audit committee. Review after a set period.
Control point: whichever option is chosen, the audit committee should approve the scope and receive the reports directly.

Answer: Create an internal audit function now because of the size, stock losses and weak procedures. A co-sourced model is a sensible start: outsource specialist and store-visit work, and build a small in-house team over time. Whichever model is used, the head of internal audit should report to the audit committee, and the provider should not be the external auditor.

Exam tips

Always tie each point to a case fact. Generic lists earn few marks, while applied points earn analysis and commercial acumen skills marks.
When the requirement says independence, check four things in the case: reporting line, access, who controls budget and appointment, and past roles of the auditors.
For comparison questions, use a clear structure by purpose, appointment, scope, reporting and independence. Do not just describe each type separately.
Match your format to the requirement, such as a briefing note for the audit committee. Open with a short conclusion and keep a professional tone.
Do not treat internal audit as a cure for everything. Say management owns controls, and note the cost and limits of the function.

Practice questions from Management and internal control systems

Internal Audit Function and Its Role in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function and Its Role: frequently asked questions

What is the role of internal audit in SBL?

It gives the board independent assurance and advice on risk management, internal control and governance. It reviews whether controls work and whether risks are managed. It reports to the audit committee and management but does not own the controls.

How is internal audit different from external audit?

External audit is required by law for many companies, is appointed by shareholders, and gives an opinion on the financial statements. Internal audit is set up by the organisation, has a wider scope set by the board, and reports on risk, control and operations. Both aim for objectivity, but their purpose and reporting differ.

How can internal audit be made independent?

Have the head of internal audit report functionally to the audit committee. Let the committee approve the plan, budget, appointment and removal. Give unrestricted access to records and staff, and avoid auditing areas the auditors have managed. This reduces, but does not remove, the risk to objectivity.

Should a company outsource internal audit?

It depends on size, risk, skills needed and cost. Outsourcing gives specialist skills and flexibility but less business knowledge. In the exam, weigh both options against the case facts and give a reasoned recommendation.