What is internal audit, and what does a mid-sized company actually get from it? | MFT

Short answer

Internal audit is an independent, objective function that tests whether a company’s risk management, controls and governance actually work, and reports findings and recommendations to the board or owners. Unlike an external audit, which gives an opinion on the annual financial statements for outside users, internal audit works for the organisation throughout the year and looks forward.

Key takeaways

External audit gives an opinion on the financial statements; internal audit tests whether the controls behind them work.
Independence comes from the reporting line: internal audit reports to the board or owners, not to the people it reviews.
A useful engagement starts from a risk assessment, not a fixed checklist.
Every finding should name an owner, a deadline and how the fix will be verified.

Most owners first meet the word audit through their external auditor: a firm that arrives after year-end, asks for confirmations and schedules, and signs an opinion on the financial statements. So when someone proposes internal audit, the natural assumption is that it is the same exercise, done more often, by someone closer to home. It is not, and the difference decides whether the money spent on it returns anything.

What is internal audit?

The Institute of Internal Auditors, which sets the global standards for the profession, describes internal auditing as independent and objective assurance and advice that helps an organisation protect and create value. In practice that means a systematic, disciplined look at three things: how the business identifies and manages risk, whether its controls work as designed, and whether governance gives the board and owners an accurate picture. The output is not an opinion on the numbers. It is a set of findings and recommendations about the system that produces them.

How is it different from an external audit?

Purpose: the external auditor expresses an opinion on whether the financial statements are fairly presented; internal audit evaluates whether risk, control and governance processes are effective.
Audience: the external opinion is for shareholders, lenders, tax authorities and other outside users; internal audit reports to the board, the audit committee or the owners.
Timing: the external audit looks back at a closed year; internal audit works through the year and looks at what is happening now and what could go wrong next.
Scope: the external auditor is bound by the financial statements; internal audit can review procurement, inventory, payroll, system access, compliance, or anything the risk assessment points to.
Standards: external auditors work under the International Standards on Auditing; internal auditors follow the IIA’s Global Internal Audit Standards.

The two are complementary. A good internal audit function gives the external auditor a stronger control environment to rely on and a documented evidence trail, which usually shortens the year-end work. It does not replace the external audit, and it should never be sold as if it does.

Where does independence come from?

An internal auditor who reports to the finance manager cannot credibly report on the finance manager’s controls. Independence is a matter of reporting line: the function, whether in-house or outsourced, reports its findings to the board, an audit committee, or in an owner-managed company directly to the owners. Management responds to the findings and owns the fixes. The auditor does not design the controls it later tests, and does not run the processes it reviews.

What does a small or mid-sized company actually get?

A company without an audit committee or a dedicated team does not need a large department. It needs a structured programme sized to its risks. When MFT runs internal audit for an owner-managed business, the engagement usually delivers the following.

A risk assessment that ranks the business processes by what could go wrong and how much it would matter, so the work starts where the exposure is.
An annual audit plan agreed with the owners, covering the high-risk processes first: typically purchasing and payments, sales and receivables, inventory, payroll and system access.
Testing of the controls in those processes, including segregation of duties, approval limits, reconciliations and the audit trail in the ERP.
A written report per review, with each finding tied to its evidence, the risk, the root cause, a recommendation, an owner and a target date.
Follow-up: a later check that the agreed actions were implemented and actually work, not only that someone said they were done.

What makes a finding useful?

A finding that says “controls over payments should be strengthened” is not a finding. A useful one states what was tested, what was found, why it matters, and what would fix it. For example: vendor bank details can be changed by the same user who releases payments, and nobody reviews the changes, so a fraudulent change could go unnoticed; restrict the change to a separate role and review a change log monthly. An anomaly is reported as an anomaly, with its evidence. Whether it is an error, a weakness or something worse is established by investigation, not assumed in the report.

External audit tells you whether last year’s numbers were fair. Internal audit tells you whether next year’s will be.

When is the right time to start?

The usual triggers are growth that has outpaced the finance team, a new ERP going live, a second branch or a second country, preparing for investors or a bank facility, or an owner who no longer sees every payment personally. Each of these moves decisions away from the people who used to check them by eye. Internal audit puts a structured check in place of that personal oversight, before a surprise forces the question.

Talk to MFT about this

Questions people ask

Is internal audit mandatory for private companies?

Generally not, although requirements depend on the country, the sector and whether the company is listed or regulated, so check what applies to you. Most private companies adopt internal audit voluntarily because owners, lenders or investors want assurance over controls.

Can internal audit be outsourced?

Yes. Many small and mid-sized companies outsource or co-source internal audit to a specialist firm. Independence still depends on the reporting line: the provider reports to the board or owners, and management remains responsible for the controls.

How often should internal audit report?

Most programmes report after each review and give the board or owners a periodic summary, often quarterly, of findings and the status of agreed actions. The frequency should follow the risk assessment rather than a fixed calendar.

About the author

Ahmed Ashraf Mostafa

Founder and CEO, Modern Financial Technology

Licensed auditor and the founder of MFT. Ahmed built the firm from a financial audit practice into an Odoo implementation and Virtual CFO business serving Egypt and Saudi Arabia, and still leads client engagements. He writes about what the ledger actually shows.

Talk to a CPA, not a sales rep.

A 30-minute call to understand your entity, your systems and what a decision-ready close would look like. Free, and you leave with one concrete next step.