Definition
Internal audit is performed by people within the organization who are independent of the activities they review. The Institute of Internal Auditors (IIA) describes its purpose as strengthening the organization's ability to create, protect and sustain value by giving the board and management independent, risk-based and objective assurance, advice, insight and foresight. It differs from an external audit of financial statements, which is performed by an auditor independent of the entity and reports to users.
Why it matters in an audit or review
An external auditor can use internal audit's work under AU-C 610, after evaluating its objectivity and competence, and can use internal auditors for direct assistance in limited ways. Strong internal audit also affects the control environment and the auditor's risk assessment.
Example
Illustrative: a company's internal audit team tests purchasing controls each year. The external auditor reads the report, evaluates the team's objectivity and competence and decides whether to use the work for planning, without relying on it for the opinion.
Common mistakes
- Confusing internal audit with external audit or with management's monitoring.
- Treating internal audit conclusions as audit evidence without evaluation.
Sources
- The IIA, Global Internal Audit Standards (2024), Domain I, Purpose of Internal Auditing, https://www.theiia.org
- AICPA, AU-C Section 610, Using the Work of Internal Auditors
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error