Internal Audit vs External Audit: Scope, Standards, Independence and How They Work Together

Internal audit and external audit both examine how an organization operates and reports, but they do different jobs for different readers. External audit gives an independent opinion on the financial statements for outside users. Internal audit is a function inside the organization that gives the board and management assurance and advice about governance, risk management and controls, including but not limited to financial reporting.

For finance teams, the practical issues are who asks for what, how much the external auditor can lean on internal audit's work, and what a CPA firm can and cannot do if it serves a client as both. This guide covers each.

The core differences

Standards

Internal audit. The Institute of Internal Auditors (IIA) issued the Global Internal Audit Standards, effective January 9, 2025. They are organized into five domains: Purpose of Internal Auditing, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function and Performing Internal Audit Services. Conformance is expected of IIA members and of those who hold IIA credentials. They are not a legal requirement for most private companies. Some regulators and exchanges require an internal audit function, and the standard that governs it varies by sector.

External audit. A nonissuer audit follows generally accepted auditing standards issued by the AICPA's Auditing Standards Board. See GAAS. An issuer audit follows the PCAOB's standards. A governmental or federal award audit also follows the Yellow Book. See Yellow Book (GAGAS).

Independence

External auditors must be independent of the entity in fact and appearance. Internal auditors are employees, so their independence is organizational: the head of internal audit reports functionally to the board or audit committee, not only to the CFO, and has unrestricted access to records and people.

The two forms of independence are different. An internal auditor can be objective and still be part of the organization. An external auditor who prepares the books has a threat to independence under the AICPA Code. See independence and nonattest services.

How does the external auditor use internal audit's work?

Under AU-C 315, the external auditor obtains an understanding of the entity's internal audit function, if it has one, to understand its activities and how they relate to internal control and financial reporting. AU-C 610 then governs two ways of using internal audit:

1. Using the work of the internal audit function. The external auditor evaluates whether the function's work can be used, considering its objectivity, competence and whether it applies a systematic and disciplined approach, including quality control. If so, the auditor decides how much to use based on the nature and extent of the work and the risk involved, then evaluates and reperforms enough of the work to conclude it is adequate.
2. Using internal auditors to provide direct assistance, which means they work under the external auditor's direction and supervision on the audit. This is permitted in a nonissuer audit subject to conditions: applicable law or regulation must not prohibit it, and the auditor must evaluate the internal auditors' objectivity and competence. Direct assistance cannot be used for judgments such as the assessment of significant risks or the evaluation of sufficiency of evidence.

The external auditor keeps sole responsibility for the opinion and may not refer to internal audit's work in the report. See relying on internal audit under AU-C 610 and direct assistance.

For issuers, PCAOB standards cover the consideration of the internal audit function and the use of the work of others in the audit of internal control (AS 2605 and AS 2201). The rules differ from AU-C 610, so do not apply the nonissuer rules to an issuer audit.

Can a CPA firm provide internal audit services to an audit client?

For a nonissuer, the AICPA Code allows a firm to provide internal audit assistance services to an attest client if the firm meets the general requirements for nonattest services and does not assume management responsibilities. The firm should not act as the client's internal audit function in a way that makes decisions for management, and the client must designate someone with suitable skill, knowledge and experience to oversee the work. For an issuer, the Sarbanes-Oxley Act prohibits the auditor from providing internal audit outsourcing services to an audit client. See the SOX compliance guide.

Where independence cannot be preserved, the client uses a different firm for internal audit. See nonattest services and the independence confirmation form.

Worked example: reliance on internal audit's inventory counts

Illustrative. A retail chain with 12 stores has an internal audit function that reports to the audit committee. Each quarter it observes and recounts the inventory at all stores. The external auditor is planning the year-end inventory work.

Evaluate the function. The auditor reviews the department's charter and reporting line (objectivity), staff qualifications and training (competence), and its methodology, supervision and review (systematic approach). All three are adequate.

Decide how much to use. Inventory is a significant balance, so the risk is high and judgment is involved in count-sheet reviews. The auditor decides to use internal audit's counts at the 8 lower-risk stores for the interim analysis, and to attend the year-end counts at the 4 largest stores itself.

Test the work. For the stores relied on, the auditor reperforms internal audit's test counts for a selection of items at 2 of the 8 stores and reviews working papers for all 8. There are no differences beyond rounding.

Conclude. The auditor documents the evaluation, what was relied on, the reperformance and the conclusion. The inventory work at the 4 large stores is performed and documented by the external audit team. The report makes no reference to internal audit.

The split between the 4 stores the auditor covered itself and the 8 it covered with internal audit's work is a judgment about risk, and a different risk assessment would produce a different split. See inventory observation.

When does an organization need each?

• External audit: required by law, lenders, investors or funders, or wanted for credibility. See what is an audit.
• Internal audit: required for some regulated entities and listed companies, and valuable for any organization with complex operations, geographically dispersed units or high fraud or compliance risk. Smaller organizations sometimes use a co-sourced model, where a firm supplies staff under the audit committee's direction.

Common mistakes

• Assuming internal audit's work reduces external audit work automatically. It does so only after the external auditor evaluates and tests it.
• Using the same firm for internal audit outsourcing and the audit without evaluating independence.
• An internal audit head who reports only to the CFO, which weakens objectivity.
• Treating an internal audit report as the external auditor's evidence without reperformance.

Frequently asked questions

What is the main difference between internal and external audit?

Internal audit is an organization's own function that gives assurance and advice on governance, risk and control. External audit is an independent opinion on the financial statements for outside users.

Can internal audit replace the external audit?

No. An external audit is a separate requirement, performed by an independent CPA firm.

Who does internal audit report to?

Best practice has the chief audit executive reporting functionally to the board or audit committee and administratively to a senior executive.

Can the external auditor rely on internal audit?

Under AU-C 610, the external auditor may use internal audit's work after evaluating its objectivity and competence and testing it, and may use internal auditors for direct assistance in a nonissuer audit under conditions.

Can the external auditor do the internal audit?

For issuers, no, since internal audit outsourcing is prohibited. For nonissuers, only within the AICPA independence rules.

Sources

• IIA, Global Internal Audit Standards (effective January 9, 2025), theiia.org
• AICPA, AU-C Section 610, Using the Work of Internal Auditors, and AU-C 315
• AICPA, Code of Professional Conduct, ET 1.295, Nonattest Services
• PCAOB, AS 2605 and AS 2201, pcaobus.org
• Sarbanes-Oxley Act of 2002, section 201 (prohibited non-audit services)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error