Internal audit: concept, role and its place in internal control

The finance director of a manufacturing company says: "We are audited every year by an outside firm, so why do we need our own internal auditors?" The reason is that the external audit looks back at the financial statements once a year, and reports to the shareholders.

The company needs someone inside it, every day, checking that controls work, that risks are managed, that laws are followed and that money is not being wasted. That person is the internal auditor.

This topic covers what internal audit is, what internal auditors do, how internal audit helps the board and the audit committee, the benefits and limits of internal audit, how to protect its independence, and its link with risk management. The next topic compares internal and external audit and the one after covers assignments.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, introduction to assurance, legal and regulatory frameworks, and audit process (20% of marks). It covers:

• the role of the internal audit department in maintaining an effective internal control system
• the comparison of internal and external audit
• the nature and use of internal control

CAMA 2020 and internal audit

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

What internal audit is

Internal audit consists of audit, investigation or review work carried out on a voluntary basis by an entity for its own control purposes. It may be done by the entity's own full-time staff or by an outside firm of accountants. No law or regulation requires internal audit for companies generally, so an entity does it only if it believes the benefits are worth the cost.

Regulators in some sectors, such as banking, do expect an internal audit function. Because there is no general requirement, the nature of internal audit varies widely with the size and structure of the entity, the nature of its business, the extent of regulation of its industry and markets, the extent of computerisation, management's attitude to risk management and the control risks it sees.

What internal auditors do

International Standard on Auditing (ISA) 610, Using the Work of Internal Auditors, says that internal audit activities usually include one or more of the following:

1. Monitoring of internal control. Setting up an adequate control system is management's responsibility and part of good corporate governance. Because the system has to be monitored all the time, large companies set up an internal audit function to help. It reviews controls, monitors how they operate and recommends improvements in a report to the directors.
2. Examination of financial and operating information. This includes review of how the information is identified, measured, classified and reported, and inquiry into individual items, including detailed testing of transactions, balances and procedures. This is very like the external auditor's work.
3. Review of the economy, efficiency and effectiveness of operations, including non-financial controls.
4. Review of compliance with laws, regulations and other external requirements, and with internal policies and directives.
5. Special investigations into particular areas such as suspected fraud.

More specifically the work includes audits of the adequacy of financial controls and operational controls in particular areas; audits of the controls in the information technology systems; value for money audits; compliance checks, such as a bank's checks on rules for preventing money laundering or an oil company's checks on health and safety at its sites; review of the financial information the entity produces; and special investigations into suspected fraud.

Most of these are operational internal audit assignments, covered in a later topic.

The role of internal audit in maintaining an effective internal control system

Management and the board, and not internal audit, are responsible for designing and operating internal controls. Internal audit supports them by monitoring. It tests whether controls exist and work, reports weaknesses to management and the audit committee with recommendations, and later checks whether the recommendations were carried out.

In a public company the audit committee can authorise the internal auditor to investigate any activity of interest or concern to it, and keeps the system of accounting and internal control under review (section 404(7)(d) and (f) of the Companies and Allied Matters Act 2020 (CAMA 2020)). In this way internal audit is the committee's own eyes inside the business.

Benefits of internal audit

• Improvements in financial and operational controls.
• Better compliance with key laws and regulations, which reduces the risk of legal action or regulatory action against the entity.
• Better economy, efficiency and effectiveness of operations.
• Reliance by the external auditors on the internal auditors' tests of financial controls, which saves time and may reduce the external audit fee.
• A better reputation for sound corporate governance among customers and investors.

Independence of the internal auditors and other problems

Internal auditors should be independent, but they cannot reach the same degree of independence as the external auditor. Full-time internal auditors are employees who depend on the entity for their job and pay. Even an outside firm that does internal audit may lack independence, because the work is not required by law and the firm depends on the client's goodwill for its future fees.

A key point is whom the chief internal auditor reports to. The best arrangement is to report to the highest level of management or to the audit committee. Reporting to the finance director threatens independence, because much of the work examines controls for which the finance director is responsible. Measures that protect independence are:

• Reporting line: the chief internal auditor reports to the audit committee, not to the finance director or chief accountant.
• Scope of work: decided by the chief internal auditor or the audit committee, not by the finance director or by the line managers whose operations may be audited. Otherwise the auditors could be directed to harmless areas.
• Rotation of staff: internal auditors should be rotated regularly, say every three to five years, and moved to other jobs, to prevent over-familiarity.
• Appointment of the chief internal auditor: by the audit committee, subject perhaps to board approval, so that no executive with a self-interest picks a "yes man".
• No design of controls: internal auditors must not design controls, because they would be auditing their own work. Management designs and implements them, taking advice from the external auditors where weaknesses are found.

Weaknesses and limitations of internal audit

Since internal audit is not a legal requirement, there is no rule that internal auditors must be professionally qualified. The entity decides what qualifications and experience to require. The external auditor, by contrast, must meet the requirements set by law and by his professional body on technical and professional standards and qualifications. An internal auditor who belongs to a professional body such as ICAN must still follow that body's rules.

The two main arguments against having an internal audit department are the cost and the difficulty of making the auditors truly independent.

Internal audit and risk assessment

Management puts internal controls in place to manage the entity's governance risks. A risk is anything that could stop the organisation from achieving its objectives, such as the risk of errors, fraud or unreliable information. The internal auditor's work often includes a risk assessment exercise to identify the main risks, which are reported to management with suggestions for managing them. Internal auditors usually group risks into three categories:

The May 2026 examination described New Breath Bank Plc where an internal audit department existed but performed only compliance reviews and there were no strong risk management processes. That shows a function that does not cover operational and financial risk and does not help the board manage risk, which is itself a weakness in the control environment.

Management of risk

Management cannot usually remove risk completely. It manages risk by limiting the likelihood or frequency of adverse events and limiting their impact when they occur. The internal auditor may recommend one of four responses:

• Acceptance: accept the risk and do nothing, which is normally acceptable only if the risk is insignificant.
• Reduction: take measures to reduce the likelihood or the consequences. Most internal controls are risk reduction measures.
• Avoidance: avoid transactions or situations that create the exposure. For a company this usually means leaving the activity.
• Transfer: pass the risk to a third party, often for a payment, as with insurance against a premium.

Worked examples

1. The finance director is responsible for much of what is audited, so independence is threatened.
2. The auditor should report to the audit committee, which should decide the scope.

1. He is auditing his own work: a self-review threat.
2. Management should design and implement controls, and internal audit should test them.

1. This is a financial risk.
2. Responses: reduce it by hedging or by invoicing in naira; transfer it through a forward contract with a bank; accept it only if the amount is small.

1. The external auditors may rely on that work in part.
2. This may reduce their time and the audit fee.

How to score full marks

• Define internal audit as voluntary, for the entity's own purposes.
• List the five ISA 610 activities.
• For independence give the five measures, then say it can never match the external auditor's.
• For risk name the three types and four responses.

Common mistakes in the exam

• Saying internal audit is required by company law for all companies.
• Giving the finance director as the proper reporting line.
• Saying internal auditors design the controls.
• Mixing up risk avoidance and risk reduction.

Quick revision

• Voluntary, for the entity's own control.
• Five activities: controls, information, value for money, compliance, investigations.
• Independence: audit committee, scope, rotation, appointment, no design.
• Risks: operational, financial, compliance. Responses: accept, reduce, avoid, transfer.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.