Internal audit and its types

The external auditor reports to the shareholders once a year. Inside the company, another group of auditors works every day for management. They test the controls, check that branches follow the rules and ask whether money is being spent well. Without them, many large businesses would not know what was happening in their own operations.

This topic describes the internal audit function: what it is, why companies have one, what it does, and how it differs from external audit. It then covers the types of internal audit: financial, operational and compliance, with energy, social, environmental and human resource audits. May 2026 Question 3(b) asked why internal audit matters to an organisation, and the answer is a list you can learn.

What internal audit is

The syllabus defines the role of the internal audit function as “an appraisal system established by management for the review of the accounting and internal control systems as a service to the entity”. The parts of that definition are:

• internal auditing is an appraisal system;
• it is established by management as a service to the entity;
• it involves the review of accounting systems; and
• it involves the review of internal control systems, which are financial, operational and compliance controls.

Internal auditing is a separate branch of the accounting profession. It has become more important in larger entities and is now seen as an important management tool.

Why internal audit matters

There is no legal requirement for an entity to set up an internal audit function. The fact that many do so shows the benefits. The syllabus gives these reasons.

1. Monitoring controls. As entities grow, become more complex and go global, controls are harder to monitor. Internal audit helps management do so.
2. Efficiency of operations. As markets become more competitive, entities need to use resources efficiently and effectively, and internal audit can monitor this.
3. Compliance. There is a great deal of statutory, accounting and governance regulation, and management can use internal audit to check compliance with laws and regulations.
4. IT systems. Many entities use complex IT systems, and specialist internal auditors can review the effectiveness of IT controls through IT audits.
5. Cost of external audit. Because external audit fees are rising, it may be cheaper to use internal auditors for audit tasks wherever possible.
6. Other work. Internal audit can do work not related to the external audit that might otherwise be given to an outside firm as non-audit work.

Background: The Pathfinder solution to May 2026 Question 3(b) adds a seventh point: an internal audit department may improve the entity’s reputation for sound corporate governance in the eyes of customers and investors. Add it to your list.

Internal audit is also an essential tool for companies that work on many sites. Senior management can use it to carry out “external” checks on operating departments. Surprise visits can confirm that every location applies controls and complies with laws, and the largest or highest-risk locations can be visited more often.

Typical functions of internal audit

The scope and objectives of internal audit vary widely. They depend on the size and structure of the entity and on what management requires. Activities usually include one or more of the following.

Evaluating the internal audit function

The external auditor, and the board, can judge the function by:

• the quality of the reports it produces;
• the qualifications and experience of its staff;
• whether it exercises due professional care;
• its degree of independence;
• the resources available; and
• the scope of the work performed.

External and internal audit compared

The two roles often use similar procedures, but they differ in fundamental ways.

Types of internal audit

Internal auditors may do financial audits, and often have a wider role. In many large entities they also do energy, social, environmental and human resource audits.

Financial audits

Financial audits are the traditional role. Internal auditors may be asked to review accounting and other records to support the figures in the financial statements and management accounts. Because this overlaps with the external auditor’s work, the external auditor may be able to rely on it (see the topic on reliance on internal audit). It is now a relatively minor part of internal audit’s total work.

But it lets internal auditors look at the controls that limit risk, find weaknesses and recommend improvements.

Operational audits

Operational audits examine the entity’s internal control procedures and whether the control systems that management set up are operating effectively. The department then recommends improvements to the system or to how it is run. VFM audits, which an external firm can also do, may be done by internal audit.

The best combination of the 3 Es is seen as a strategy for maximising profit performance. It is not usually possible to reach objectives (effectiveness) by using the cheapest resources (economy) in the most productive way (efficiency). Sometimes greater efficiency can only be had by spending more, so a balance is needed between economy and efficiency.

Sometimes the benefit of greater effectiveness does not justify the extra cost, so a balance is needed between economy and effectiveness. One purpose of a VFM audit is to check that the most appropriate balance is being achieved.

Compliance audits

Entities must follow many laws and regulations, and they risk regulatory action if they do not. Which ones matter depends on the industry: health and hygiene controls for food manufacturers, pollution controls for oil and gas companies, money laundering controls for financial services and safety controls for public transport. Internal audit is a tool management can use to confirm that significant laws and regulations are being followed.

Other audits

• Energy audits: checks on how the entity uses energy and whether its operations are energy-efficient.
• Social audits: checks on the entity’s impact on the society in which it operates.
• Environmental audits: checks on the effect on the natural environment, including sustainable materials, recycling and pollution.
• Human resource audits: checks on whether the entity has adequate systems for recruiting, training and developing staff to meet current and future needs.

The rules in more depth

Independence of internal audit

Internal auditors work for management, so they are not independent in the way the external auditor is. Their independence is a matter of degree. It is helped if they report to the audit committee or the board and not to the finance director whose area they review. The earlier topic on reliance on internal audit uses the degree of independence as one of the factors for the external auditor.

Why the types overlap

A single review can be financial, operational and compliance at the same time. A review of payroll, for instance, tests the figures, asks whether the process is efficient and checks compliance with tax rules. The labels in the syllabus are for convenience, so say which type the question asks for and cover the others briefly.

Internal audit and risk

A department that does only compliance checks, as in the May 2026 case, adds less value than one that also focuses on risk management. The scenario asked about the importance of the function because the department seemed under-resourced and narrow.

Worked example: the cheapest option is not always the best value

Scenario. An internal audit VFM review at a distribution company looks at the purchase of a delivery van. Van A costs ₦9 million and does 7 kilometres per litre. Van B costs ₦12 million and does 10 kilometres per litre. Each will drive 60,000 kilometres a year for five years, and fuel costs ₦900 per litre.

Van A. Fuel per year is 60,000 ÷ 7 = 8,571 litres, which costs 8,571 × ₦900 = ₦7.71 million. Over five years that is ₦38.6 million. Total cost with the purchase price is ₦9 million + ₦38.6 million = ₦47.6 million.

Van B. Fuel per year is 60,000 ÷ 10 = 6,000 litres, which costs ₦5.4 million. Over five years that is ₦27.0 million. Total cost is ₦12 million + ₦27.0 million = ₦39.0 million.

Finding. Van A is more economical to buy, because it costs ₦3 million less. Van B is more efficient, because it uses less fuel for the same distance. Over five years Van B costs ₦8.6 million less. The review points out that the purchase decision looked at economy only. It recommends that purchasing considers total cost of ownership.

Effectiveness is a separate question: whether either van delivers on time to meet the company’s service targets.

How to score full marks

• Quote the definition and split it. Appraisal, established by management, accounting and internal control systems.
• Answer “importance” questions with the reasons list. Make each one specific to the entity in the scenario.
• Use the comparison table for any “distinguish” question. Duties, qualification, appointment, who sets duties, reporting line.
• Match the type of audit to the facts. Controls point to operational, regulation to compliance, records to financial.
• Link to the 3 Es when VFM is mentioned and say the balance matters.

Common mistakes in the exam

• Saying internal audit is required by law.
• Saying internal audit gives an opinion on the financial statements. That is the external auditor’s role.
• Saying internal auditors are appointed by shareholders.
• Listing only financial audits as the internal auditor’s work.
• Calling compliance with management policy outside the scope of internal audit.
• Forgetting the balance between the 3 Es.

Quick revision

• Internal audit: appraisal system set up by management to review accounting and internal control systems.
• No legal requirement. Reasons: control monitoring, efficiency, compliance, IT, cost of external audit, other work.
• Functions: monitor controls, examine information, review the 3 Es, review compliance.
• External: opinion, statute, shareholders. Internal: systems and controls, management.
• Types: financial, operational (VFM), compliance, energy, social, environmental, human resources (HR).

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.