Plain definition
Internal audit is an independent function within or engaged by an organisation that provides assurance and advice about governance, risk management, and internal controls. It evaluates whether processes are designed and operating effectively, reports its conclusions to appropriate oversight, and follows up agreed actions. It does not run the controls it audits.
Its independence comes from its mandate, access, reporting line, and freedom to communicate findings, not simply from being called “audit.” Internal audit normally provides reasonable assurance based on scoped work and evidence; it cannot guarantee that every problem, fraud, or future failure will be found.
Illustrative example
Suppose internal audit reviews the supplier-onboarding process after several bank-detail change incidents. Auditors inspect access settings, a sample of approved changes, evidence of independent callbacks, and the ageing of unreviewed exceptions. They find that the callback control is described in policy but not consistently evidenced, report the weakness to the audit committee, and agree actions with management.
Management remains responsible for changing the process. Internal audit later tests whether the agreed changes actually operate, rather than taking over the callback activity itself. The committee receives assurance about the work and its limits.
Internal audit differs from external audit: its remit is broader than financial statements and it reports within the organisation’s governance structure.
Why it matters
It gives the board and leadership an independent view of whether management’s risk and control arrangements deserve confidence.
It helps detect gaps that operational teams may overlook because they are close to the process.
Practical consequence
Protect internal audit’s access and ability to report significant findings to the audit committee or equivalent oversight body.
Use a risk-based audit plan, state scope and limitations in each report, and track management actions without making audit responsible for implementing them.