Internal audit

What it means

Internal audit is an independent, objective review that helps a company’s management find out whether processes, controls and risk management work as they should. It is carried out by the company’s own internal audit function, reporting directly to top management or the supervisory board, or by an external provider under contract.

Unlike the statutory audit, carried out by an independent auditor and checking only whether the financial statements give a true and fair view, internal audit has a wider scope. It examines purchasing, sales, warehouses, IT, HR, compliance with rules and process efficiency, and proposes improvements.

In the three lines model internal audit is the third line: it independently checks whether the first line, the teams in daily work, and the second line, such as compliance or risk management, do their job well. Its value rests on independence from those it reviews.

How it works in practice

It is mandatory mainly for banks, insurers, public bodies and some other regulated firms. We recommend it to medium-sized and larger private companies as a management tool, especially where they have several branches, large warehouses or extensive purchasing in which errors and fraud are easily hidden.

Smaller companies can use internal audit as a one-off review of a specific area, such as payment approvals, cash handling or access settings in the accounting system. The result is a report of findings, risks and recommendations and a plan of who will fix the shortcomings and by when.

From an accounting perspective, internal audit often uncovers weaknesses the statutory auditor does not see, such as missing segregation of duties or uncontrolled changes to supplier master data. Fixing them reduces the risk of fraud and the cost of the external audit.

What to watch out for

The most common mistake is internal audit that is not independent: the auditor reports to the head of the unit under review, or findings are “polished” before they reach management. Such an audit gives a false sense of security instead of real information.

The second mistake is not acting on the findings. A report that ends up in a drawer is money wasted. Management should track the corrective actions and, at the next audit, check whether the findings recur.