Compliance Management, Audit and Due Diligence · Internal Audit and Performance Audit

Internal Audit: Meaning, Scope and Objectives

Updated 11 October 2026 · Fact-checked

Internal audit is an independent, objective assurance and consulting activity inside an entity. It evaluates and improves governance, risk management and internal control. Its scope covers controls, financial and operating information, operations and compliance. In exams, define it, list objectives and scope, and contrast it with statutory audit.

Understand Internal Audit: Meaning, Scope and Objectives

An internal audit function is set up by an entity as part of its internal control and governance structure. Its purpose is to help the entity run better. It does not exist to give an opinion on the financial statements for shareholders.

SA 610 (Revised) notes that the objectives and scope of an internal audit function, its responsibilities and its organisational status vary widely. They depend on the size and structure of the entity and on what management and, where applicable, those charged with governance require. So there is no single fixed model. Always tie your answer to the entity's facts.

The typical scope has two sides: assurance and consulting. The work is designed to evaluate and improve governance processes, risk management and internal control. It covers governance (ethics, accountability, communication), risk management (identifying exposures, helping detect fraud) and internal control. Internal control work includes evaluating controls, examining financial and operating information, reviewing operating activities for economy, efficiency and effectiveness, and reviewing compliance with laws, regulations and internal policies.

The key contrast with statutory audit is the purpose. A statutory auditor reports on whether the financial statements give a true and fair view, and is independent of the entity. Internal audit serves management and those charged with governance, and is usually a continuous review of systems and operations. Even so, the two overlap. SA 610 (Revised) says the internal audit function may perform procedures similar to the external auditor's.

The external auditor may use the function in three ways: to get information for assessing risks of material misstatement, to use its work in partial substitution for audit evidence the auditor would otherwise obtain directly, or to use internal auditors for direct assistance under the auditor's direction, supervision and review. Each is subject to any restriction by law or regulation. The auditor remains responsible for the opinion.

Benefits to the entity include stronger controls, early detection of weaknesses and fraud, better risk management, improved compliance and more reliable information for decisions.

Key rules to remember

Scope of internal audit (SA 610 (Revised), A1): Governance + Risk management + Internal control (evaluation of controls, financial and operating information, operating activities, compliance); Use this as a checklist when a question asks for the scope. Both assurance and consulting activities are included.
Ways the external auditor uses internal audit (A4): (1) Risk assessment information; (2) Use of work in partial substitution for audit evidence; (3) Direct assistance; Uses (2) and (3) apply unless prohibited or restricted by law or regulation. The external auditor keeps full responsibility.
Objectives of the external auditor (para 13): Decide if and how far to use the work or direct assistance; if work is used, check it is adequate; if direct assistance, direct, supervise and review it; These apply when the auditor expects to modify the nature or timing, or reduce the extent, of procedures, or to use direct assistance.
Statutory auditor and internal audit: A statutory auditor of an entity cannot be its internal auditor; Quoted in A14 from the ICAI Code of Ethics. Reason: independence and objectivity, and the self-review threat.

How to solve Internal Audit: Meaning, Scope and Objectives questions

Use this method for any question on meaning, scope, objectives or comparison of internal audit.

1Read the verb. 'Define', 'discuss scope', 'distinguish' and 'advise' need different answers.
2Open with a one-line definition: independent, objective assurance and consulting activity within the entity that evaluates and improves governance, risk management and control.
3State the objectives or scope in short, labelled points: governance, risk management, internal control, financial and operating information, operating activities, compliance.
4If asked to compare with statutory audit, use clear heads: purpose, who it serves, independence, scope, reporting, timing and who appoints. Give one line per head.
5For a case, link the facts to the entity's size, structure and needs, since scope varies with them.
6If the external auditor is involved, add how its work may be used and that the external auditor remains responsible.
7Close with a conclusion that answers the question asked, for example whether the function's work can be used.

Quickest way: Three-pillar recall

When to use it: When you have under five minutes for a short note on internal audit.

Write the definition in one sentence.
List the three pillars: governance, risk management, internal control.
Under internal control, add the four activities: controls, information, operations, compliance.
Add one line on difference: internal audit serves management; statutory audit reports to members on financial statements.
End with one benefit line.

Common mistakes in Internal Audit: Meaning, Scope and Objectives

Saying internal audit gives an opinion on the true and fair view of the financial statements.
Students mix it up with statutory audit.
Fix: State that internal audit serves management and those charged with governance and focuses on controls, risk and operations.
Giving a fixed scope as if it applies to every entity.
Students memorise a list without the context.
Fix: Say that objectives and scope vary with the entity's size, structure and management needs.
Claiming the external auditor can rely fully on internal audit and reduce responsibility.
Students overlook the limits on use.
Fix: State that the auditor evaluates the work, may use it only in partial substitution, and keeps sole responsibility for the opinion.
Saying the statutory auditor may also act as internal auditor.
Students think both are just audits.
Fix: Quote the ICAI Code of Ethics line in A14: a statutory auditor cannot be its internal auditor, as independent and objective opinion would not be possible.
Leaving out consulting activities and treating internal audit only as assurance.
Textbook definitions stress checking and testing.
Fix: Mention both assurance and consulting in the definition.
Writing a comparison with statutory audit without heads.
Students write paragraphs and miss points.
Fix: Use fixed heads such as purpose, independence, reporting and scope, with one line each.

Worked examples

Example 1

Explain the meaning and scope of internal audit. How may an external auditor make use of an entity's internal audit function?

Show the solution

Meaning: internal audit is an independent and objective activity within the entity, with assurance and consulting elements, designed to evaluate and improve governance, risk management and internal control.
Scope on governance: assessing ethics and values, performance management and accountability, and communication among those charged with governance, auditors and management.
Scope on risk management: identifying and evaluating significant exposures, helping improve risk management and the financial reporting process, and assisting in fraud detection.
Scope on internal control: evaluating controls, examining financial and operating information, reviewing economy, efficiency and effectiveness of operations, and reviewing compliance with laws and policies.
Use by external auditor: first, information for assessing risks of material misstatement; second, unless prohibited or restricted by law, use of its work in partial substitution for audit evidence, after appropriate evaluation; third, direct assistance under the auditor's direction, supervision and review.
Conclude that scope varies with the entity and the external auditor remains responsible for the opinion.

Answer: Internal audit is an independent assurance and consulting function covering governance, risk management and internal control. The external auditor may use it for risk assessment, for partial substitution of evidence after evaluation, or for direct assistance, but stays fully responsible.

Example 2

Sunrise Textiles Ltd, a listed company in Surat, wants its statutory auditor to also carry out its internal audit to save cost. Advise the board, and distinguish between the two audits.

Show the solution

Identify the issue: a statutory auditor is proposed as internal auditor of the same entity.
State the rule: the ICAI Code of Ethics, as quoted in SA 610 (Revised) A14, says a statutory auditor of an entity cannot be its internal auditor, as it will not be possible to give an independent and objective opinion.
Give the reason: a self-review threat arises, as the engagement team may use internal audit results without proper evaluation or the same professional skepticism.
Advise: appoint a separate internal auditor, or have an in-house team, so the statutory auditor can evaluate that work independently.
Distinguish on purpose: internal audit helps management improve controls and operations; statutory audit reports on the financial statements.
Distinguish on reporting and independence: internal audit reports to management or those charged with governance; statutory audit is an independent report to members.
Distinguish on scope: internal audit covers operations, risk and compliance and is often continuous; statutory audit centres on financial statements.

Answer: The board should not appoint its statutory auditor as internal auditor. It should engage a separate internal auditor. The two audits differ in purpose, audience, independence and scope as set out above.

Exam tips

Always mention both assurance and consulting in your definition.
For comparison questions, use fixed heads and one line per head to score quickly.
Add the line that scope varies with size, structure and management needs; it shows you read the standard.
In case questions, state the rule, apply the facts, then conclude. Do not stop at theory.
Where the external auditor is involved, say it keeps sole responsibility for the audit opinion.

Practice questions from Internal Audit and Performance Audit

Internal Audit: Meaning, Scope and Objectives in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit: Meaning, Scope and Objectives: frequently asked questions

What is internal audit in simple words?

It is a check carried out inside an entity to see whether governance, risk management and controls work well. It both assures and advises management. It does not replace the statutory audit.

What is the main difference between internal audit and statutory audit?

Internal audit serves management and those charged with governance and reviews controls, risks and operations. Statutory audit gives an independent opinion on the financial statements. The statutory auditor cannot act as the entity's internal auditor.

Can a statutory auditor use the work of internal auditors?

Yes, unless law or regulation prohibits or restricts it. The auditor must evaluate the work and may use it only in partial substitution for evidence it would obtain directly. The auditor stays responsible for the opinion.

What is direct assistance under SA 610 (Revised)?

It means using internal auditors to perform audit procedures under the external auditor's direction, supervision and review. It is allowed unless prohibited or restricted by law or regulation. The auditor must consider threats to the internal auditors' objectivity.