Understanding both what distinguishes them and how they work together is important for anyone involved in governance, audit committee membership, or risk management, because getting the most from each requires understanding what the other is and is not designed to provide.
Who Performs Each and Who They Report To
Internal Auditors
Internal auditors are either employees of the organisation or an external provider contracted to deliver the internal audit function (a model known as co-sourcing or full outsourcing). In either case, internal audit's client is the organisation itself. Its functional reporting line goes to the audit committee or board, not to operational management.
This reporting line is not just an organisational convention. The IIA's Global Internal Audit Standards are explicit that the chief audit executive must have direct and unrestricted access to the board and senior management, and that functional reporting to the board is essential to the independence the function requires to deliver objective assurance. An internal audit function that reports primarily through the CFO or CEO is structurally compromised before it performs a single piece of work.
The internal audit function is funded by the organisation and serves the organisation's governance needs. Its output, findings, recommendations, and assurance opinions, is directed toward helping the organisation improve.
External Auditors
External auditors are independent professionals from a registered firm, entirely separate from the organisation. In the case of companies subject to statutory audit requirements, they are appointed by the shareholders at the annual general meeting, not by management. Their primary accountability is to shareholders and other external stakeholders, not to the company's management or board.
The appointment by shareholders is significant. It is the mechanism through which external audit maintains its independence from the management whose financial reporting it is examining. The International Standards on Auditing issued by the International Auditing and Assurance Standards Board (IAASB) govern external audit practice globally, establishing independence requirements that prevent external auditors from having financial or other relationships that could compromise their objectivity.
External audit fees are paid by the company but the function's accountability is primarily external. This creates a governance dynamic that is meaningfully different from internal audit.
What Each Examines
Internal Audit Scope
The scope of internal audit is broad, flexible, and determined primarily by the organisation's own risk-based audit planning process, subject to board approval.
A comprehensive internal audit programme can cover financial controls and processes, operational efficiency and effectiveness, compliance with regulations and internal policies, risk management practices, information technology and cybersecurity, governance arrangements and conduct, third-party relationships and supply chain risk, strategic programme delivery and change management, environmental, social, and governance matters, and emerging risks including AI governance.
The scope expands or contracts based on where risk is greatest and what the board most needs assurance over. This flexibility is one of internal audit's significant advantages: it can be directed toward whatever the organisation needs.
External Audit Scope
External audit scope is fundamentally narrower and determined not by the organisation's needs but by law, regulation, and professional auditing standards.
The primary purpose of an external audit is to express an opinion on whether the financial statements give a true and fair view of the organisation's financial position and performance, and whether they have been prepared in accordance with the applicable financial reporting framework. This is a specific, legally defined task.
The external auditor's scope expands only to the extent necessary to obtain sufficient appropriate audit evidence to support that opinion. Internal controls are examined not comprehensively but only to the extent relevant to the reliability of the financial reporting they support. Operational processes are considered only insofar as they affect the numbers in the financial statements.
This narrower scope reflects the external audit's specific purpose. It is not designed to be a comprehensive governance review. It is designed to provide shareholders with confidence that the financial statements can be relied upon.
The Different Purposes They Serve
Internal Audit Exists to Help the Organisation Improve
The IIA's definition describes internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. The focus on adding value and improvement reflects the internal audit function's role as a resource for the organisation it serves.
When internal audit identifies a control failure, the expected outcome is a management response that addresses the underlying issue, verified by follow-up work to confirm the remediation has been effective. The board uses internal audit findings to understand where governance is working well and where it needs strengthening. The function's success is measured partly by the quality of improvements that result from its work.
External Audit Exists to Provide External Assurance
External audit's purpose is fundamentally different. It exists to give shareholders, lenders, and other external stakeholders confidence that the financial statements produced by management are accurate and reliable. The IAASB's International Standards on Auditing frame the external audit as a mechanism for reducing information asymmetry between management and external stakeholders: management prepares the financial statements; external audit provides independent verification that they can be trusted.
Improvement is not the external auditor's primary goal. Where external auditors identify control weaknesses or issues in the financial reporting process, they communicate them to management and, for significant findings, to the audit committee. But the nature of the engagement is verification rather than improvement.
Independence: Different Standards for Different Purposes
Both functions require independence, but the nature and governance of that independence differ significantly.
Internal Audit Independence
Internal audit independence is primarily structural and behavioural. Structural independence requires the function to report to the audit committee rather than to management, to have its budget approved by the audit committee, and to have its chief audit executive's appointment and removal subject to board approval. Behavioural independence requires the function to report findings honestly, to be willing to challenge management, and to escalate concerns to the board when management's response is inadequate.
The IIA's standards on independence and objectivity also address threats to objectivity at the individual engagement level. An auditor who has recently worked in the area being audited, or who has personal relationships that could affect their judgement, should be identified and their involvement in the engagement managed appropriately.
External Audit Independence
External audit independence is governed by stringent professional and regulatory requirements. External auditors are prohibited from having financial interests in their clients, from having family members in key management positions at audit clients, from providing certain categories of non-audit services that could create self-review threats, and from becoming so identified with a client's management that their objectivity is compromised.
Audit firm rotation requirements, which mandate that organisations periodically change their external auditor, reflect the recognition that long-standing relationships can gradually erode the independence that makes external audit valuable. In the UK, mandatory firm rotation every twenty years and partner rotation every five years are designed to manage this risk.
How the Two Functions Work Together
External Reliance on Internal Audit
External auditors are permitted, and in practice expected, to consider the work of internal audit and to use it where appropriate as part of the basis for their audit opinion. The IAASB's International Standard on Auditing 610 governs how external auditors evaluate and use internal audit work.
Before using internal audit work, external auditors must assess the organisational status and policies supporting internal audit's objectivity; the competence of the internal audit function; whether the function applies a systematic and disciplined approach; and whether the specific internal audit work can be used for the external auditors' purposes.
Where internal audit work meets the required standard, external auditors can reduce the extent of their own direct testing. The scope of this reliance is not unlimited: external auditors retain responsibility for their opinion and cannot fully outsource their judgement to internal audit. But a credible, well-governed internal audit function can meaningfully reduce the scope of external audit fieldwork and, in turn, external audit cost.
The Audit Committee's Role in Coordinating the Two
The audit committee is the governance body that coordinates the relationship between internal and external audit. Effective coordination means ensuring that the two functions' annual plans are reviewed together so that coverage is complementary rather than duplicated. It means sharing internal audit findings with the external auditors so they understand the risk and control environment. It means ensuring external auditors' management letters and points raised during the audit are followed up and fed into internal audit planning where relevant. And it means making sure both functions have the access and resources they need to do their work effectively.
The Financial Reporting Council's Audit Committees and the External Audit guidance addresses the audit committee's responsibilities in managing this relationship in some detail.
What Good Looks Like from the Board's Perspective
The board's role is to use both functions effectively to discharge its governance responsibilities. A board that receives internal audit findings as routine items requiring brief acknowledgement, without genuine engagement with what they reveal about the organisation's risk and control environment, is not getting the value the function can provide.
Effective governance means the audit committee ensures the internal audit function has appropriate independence, resource, and access. It means using internal audit findings as genuine inputs into board discussion rather than management-approved summaries. It means understanding what external audit found, what management's response was, and whether that response has been effective. And it means recognising the difference between what each function is designed to tell it and what requires the other.
No governance structure should rely entirely on external audit for assurance about how the organisation is operating. The external auditor's scope is too narrow, its frequency too limited (typically annual), and its purpose too specifically focused on financial statement accuracy to serve as the board's primary source of governance intelligence. Internal audit, with its broad scope, its direct reporting line to the board, and its ability to follow up on findings over time, is the function designed to serve that need.
References and Further Reading
