A company has two sets of auditors. The firm appointed at the annual general meeting signs a report that the shareholders read. A team of employees in the head office writes reports for the managing director every month. Both look at controls and both test transactions, and the same invoice may be checked twice. Why have both, and how do they differ?
A candidate who can set out the differences clearly, and explain how the two work together, earns easy marks in almost every diet.
This topic compares internal and external audit on every point examiners ask about: purpose, appointment, reporting, independence, scope, qualification, focus and fraud. It also explains how the external auditor may use the work of internal audit. The previous topic covered internal audit itself, and the next covers the work it does.
In 30 seconds
External audit: required by law for companies, done by an independent qualified firm appointed by the shareholders, ending in an opinion on the financial statements for the members. Internal audit: chosen by management, done by employees or an outside firm, ending in recommendations to management and the audit committee on controls, risks and operations. Similar methods but different purposes. Independence: external is higher.
Fraud: the internal auditor may be asked to investigate; the external auditor is not responsible for detecting it. Reliance: the external auditor may use internal audit work after evaluating it, under International Standard on Auditing (ISA) 610.
Key terms in plain English
| Term | What it means |
|---|---|
| External audit | A statutory audit by an independent firm for the shareholders |
| Internal audit | A voluntary function that serves management and the board |
| Reliance | Using another party's work as audit evidence |
| Objectivity | Freedom from bias and influence |
| Competence | The skill and training to do the work properly |
| Direct assistance | Internal auditors working under the external auditor's supervision |
Syllabus check
This topic is in syllabus area A, introduction to assurance, legal and regulatory frameworks, and audit process (20% of marks). It covers:
- the comparison of internal and external audit
- the role of internal audit in maintaining an effective internal control system
- the relationship between internal and external auditors
CAMA 2020 and the two audits
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 401 | The company appoints auditors at each annual general meeting | External audit is a legal requirement |
| s. 404(1) | The auditors report to the members | The external report goes to shareholders |
| s. 404(7)(c) and (f) | The audit committee reviews findings with the external auditor and authorises internal audit investigations | The committee links the two functions |
| s. 408(1)(b) | The fee of the external auditor is fixed in general meeting or as it decides | Appointment and pay come from the shareholders |
The rules in more depth
The main differences
| Point | External audit | Internal audit |
|---|---|---|
| Purpose | To express an opinion on whether the financial statements give a true and fair view | To evaluate and improve controls, risk management and operations, and to make recommendations |
| Legal basis | Required by statute for companies, under section 401 of the Companies and Allied Matters Act 2020 (CAMA 2020), unless exempt | No general legal requirement: the entity chooses it, though regulators in some sectors expect it |
| Appointed by | The shareholders at the annual general meeting | Management, or the audit committee; may be outsourced |
| Removed by | The shareholders (the directors cannot remove) | Management |
| Reports to | The shareholders (members), under section 404(1); also the audit committee of a public company | Management, the board or the audit committee |
| Qualification | Must be qualified by law and a member of a recognised body; disqualified persons barred by section 403 | No legal requirement; the entity sets the standard, and members of ICAN follow its rules |
| Independence | Must be independent of the directors in fact and in appearance | Employees can reach only a sufficient degree of independence |
| Scope | Set by law and the standards: the financial statements as a whole | Set by management or the audit committee: any area of the business |
| Focus | Historic financial information at the year end | Current and future risks and controls throughout the year |
| Timing | Annual, with interim and final visits | Continuous or on a cycle of reviews |
| Fraud and error | No specific duty to find fraud, only to give reasonable assurance that the statements are free from material misstatement | May be asked to investigate suspected fraud and error, with a lower materiality |
| Materiality | Set for the financial statements as a whole | Often much lower, since the aim is control improvement |
| Standards | International Standards on Auditing | The entity's own methods and the standards of the institute of internal auditors, with ISA 610 as a guide for the external auditor |
| Liability | To the company and, in some cases, to others who rely on the report | To the employer |
What they have in common
The two roles often use similar procedures: inspection of documents, observation, confirmation, re-performance, analytical procedures, enquiry and testing of controls. Both aim to improve the reliability of information and both report weaknesses in controls. Both need professional competence and objectivity, and both are expected to document their work. In a practical question the audit steps for one are often the same as for the other.
Why the differences matter
The main point is who the report is for. The external auditor's report is for the owners and the public who rely on the statements, so the auditor must be free of the directors' influence. The internal auditor's report is for management and the board, to help them run the business, so he can work closely with them but cannot be as independent.
Because internal audit is not required by law, a company can change its scope, size or even abolish it, while the external audit cannot be dropped except as the law allows.
Using the work of internal audit
The external auditor may find that the internal auditors have tested the same controls. ISA 610 allows the external auditor to use that work, but the external auditor stays solely responsible for the audit opinion and cannot hand over judgement to anyone. Before relying on the work the external auditor evaluates:
- the objectivity of the internal audit function: its status in the organisation, its reporting line and its freedom from management's influence;
- its competence: the qualifications, training and experience of the staff;
- whether it applies a systematic and disciplined approach, including quality control; and
- whether the work is adequate for the external audit, after the external auditor has re-tested a sample of it.
If the function passes those tests, the external auditor may reduce the work done on areas the internal auditors covered, and may even use internal auditors to give direct assistance under supervision. The external auditor can never rely on internal audit for areas of high risk or high judgement, such as accounting estimates and the going concern assessment.
Co-operation between the two
The two work best together. They share their plans so that the same ground is not covered twice and gaps are not left. The external auditor reads the internal audit reports to understand the controls and the risks, and the internal auditor learns of weaknesses the external auditor found.
Both report to the audit committee of a public company, which under section 404(7) of CAMA 2020 reviews the scope and planning of the audit, reviews findings with the external auditor and authorises the internal auditor to investigate matters of concern. This arrangement gives the board a clearer view of the entity than either alone.
Worked examples
Example 1: who is the report for? A shareholder asks for the internal audit report on the sales department.
- The internal audit report is addressed to management and the audit committee, not to the shareholders.
- The shareholders receive the external auditor's report on the financial statements.
Example 2: reliance. Internal audit tests the payroll controls every quarter, is staffed by qualified accountants and reports to the audit committee. The external auditor wants to rely on it.
- The function appears objective (audit committee reporting) and competent (qualified staff).
- The external auditor checks the approach and re-tests a sample of its work.
- If satisfied, the external auditor may reduce its own testing of the payroll controls but stays responsible for the opinion.
Example 3: fraud. The managing director suspects that the stores manager is stealing inventory.
- The internal auditors may be asked to investigate it, with a low materiality.
- The external auditor is not responsible for finding every fraud, only for reasonable assurance on material misstatement.
Example 4: removal. The directors want to dismiss both sets of auditors because they have criticised the budgeting process.
- The directors may dismiss the internal auditors, who are employees, although doing so for criticism would weaken governance.
- They cannot remove the external auditor: only the shareholders can.
How to score full marks
- Use a table with at least six rows: purpose, appointment, reporting, independence, scope, qualification.
- Give a reason for each difference, not just a label.
- Mention reliance under ISA 610 and the tests of objectivity and competence.
- End with how the two co-operate.
Common mistakes in the exam
- Saying the internal auditor reports to the shareholders.
- Saying the external auditor is responsible for preventing fraud.
- Saying internal audit is required by law.
- Allowing the external auditor to give up responsibility for the opinion when relying on internal audit.
Quick revision
- External: statutory, shareholders, opinion, independent.
- Internal: voluntary, management, recommendations, less independent.
- Similar procedures, different purposes.
- ISA 610 reliance: objectivity, competence, discipline, re-test.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. The external auditor is appointed by the:
- Shareholders
- Directors
- Internal audit
- Registrar
Show the answer
A. At the annual general meeting.
Question 2. The internal auditor usually reports to:
- Shareholders
- Management or the audit committee
- The registrar
- The public
Show the answer
B. Management and the committee.
Question 3. Which is true of internal audit?
- It is required for every company
- It is chosen by the entity
- It ends in a statutory opinion
- It is done only by outsiders
Show the answer
B. It is voluntary.
Question 4. Who can remove the external auditor?
- The directors
- The shareholders
- Internal audit
- The tax authority
Show the answer
B. Not the directors.
Question 5. The external auditor's responsibility for fraud is to:
- Prevent all fraud
- Obtain reasonable assurance that the statements are free from material misstatement
- Ignore it
- Report it to the press
Show the answer
B. No specific duty to detect all fraud.
Question 6. Before relying on internal audit, the external auditor evaluates:
- Its fee
- Its objectivity and competence
- Its size
- Its location
Show the answer
B. Objectivity, competence and approach.
Question 7. After relying on internal audit, responsibility for the opinion remains with the:
- Internal auditor
- External auditor
- Management
- Audit committee
Show the answer
B. The external auditor is solely responsible.
Question 8. Internal audit usually has materiality that is:
- Higher
- Lower
- The same
- Not used
Show the answer
B. Often much lower.
Question 9. A common feature of both audits is that they:
- Use similar procedures
- Report to shareholders
- Are required by law
- Are done only once a year
Show the answer
A. Methods overlap.
Question 10. Which work should the external auditor NOT rely on internal audit for?
- Routine payroll control tests
- High-judgement areas such as going concern
- Stock count schedules
- Cash handling tests
Show the answer
B. High-risk and high-judgement areas need the auditor's own work.
Question 11 (10 marks). Distinguish between internal audit and external audit under six headings. (9 marks)
Question 12 (10 marks). Explain the factors the external auditor considers before relying on the work of internal audit. (6 marks)
Question 13 (10 marks). Explain how the internal and external auditors can co-operate. (5 marks)
Model answers
Show the model answer to Question 11
Any six, 1.5 each:
- purpose (opinion v improvement)
- legal basis (statutory v voluntary)
- appointed by (shareholders v management)
- reports to (members v management or committee)
- independence (higher v sufficient)
- scope (set by law and standards v set by management)
- qualification (required v not required)
- focus (historic financial v current risks and operations)
- fraud (no specific duty v may investigate)
Show the model answer to Question 12
Objectivity (status, reporting line); competence (qualifications, experience); systematic and disciplined approach with quality control; adequacy of the work after re-testing a sample; the external auditor remains responsible and does not rely in high-risk areas. (1.5 each, to 6)
Show the model answer to Question 13
Share plans to avoid duplication; external auditor reads internal reports to understand risks and controls; internal auditor learns of external findings; both report to the audit committee; regular meetings. (1 each, to 5)
Spotted a mistake? Tell us and we will check it.
