Internal Audit

The function sits in the third line of the organisation, apart from the managers whose work it reviews. Its head, the chief audit executive, reports functionally to the audit committee, which approves the plan and protects the team's independence. Auditors plan reviews around risk, gather evidence, test controls, and report findings with ratings and agreed actions. They also follow up to see whether the actions were completed. Reviews cover many topics: financial processes, lending, procurement, cyber security, compliance with laws and whether operations meet their goals. Some reviews ask whether a process achieves its purpose, and not only whether rules were followed. Internal audit also gives advice, though it should not take management decisions. It is different from external audit, which gives an opinion on the financial statements. Directors lean on it for a view of the organisation that does not come from the managers being reviewed.

A logistics company's internal audit team reviews how drivers' expense claims are approved. It samples two hundred claims, finds that managers approve in bulk without checking receipts, and rates the issue as high. Management agrees to introduce receipt checks, and the team returns three months later to confirm they are working.