Internal Audit

What Is an Internal Audit?

An internal audit is a review performed by people who work for the organization being examined. Its purpose is to give management and the board of directors independent assurance that the company's internal controls, risk management, and governance processes are working as intended. Internal auditors also offer advice on how processes could be improved. The work is organized around a plan based on risk, and the findings are reported to senior leadership and, usually, to the audit committee.

How It Works

Internal auditors typically begin by identifying the areas of greatest risk, such as financial reporting, information technology, or compliance with regulations. They then examine documents, test whether controls operate as described, interview staff, and compare actual practice with policy. When they find weaknesses, they rate their significance, recommend corrective action, and follow up later to confirm that management has fixed the problem.

Many internal audit functions follow the professional standards of the Institute of Internal Auditors, published as the International Professional Practices Framework. The function is designed to be independent of the activities it reviews, so auditors report to the audit committee rather than to the managers whose work they examine.

Internal Audit and External Audit

An external audit is performed by an outside firm and focuses mainly on whether a company's financial statements are presented fairly under the applicable accounting rules. An internal audit covers a much wider scope, including operational efficiency and risk, and its results are generally shared inside the company rather than published. The two often complement each other, since external auditors may rely on internal work when assessing controls.

Why It Matters to Investors

Investors cannot usually read an internal audit report directly, but its existence and reporting line are often described in a company's annual filings and corporate governance disclosures. A strong internal audit function can be one sign that management takes controls seriously. Weak or repeated findings, particularly in financial reporting, may point to risks worth examining. Internal audit is not a guarantee that problems will be prevented, and it works within the limits of the time and resources allocated to it.