Internal Audit

What is internal audit - and why it matters?

Internal audit provides independent assurance that an organisation’s risk management, governance and control processes are operating effectively. It offers an objective view of how well risks are being managed, identifying areas of strength and where improvements are needed. When delivered effectively, internal audit goes beyond compliance. It provides insight, strengthens decision-making and supports continuous improvement across the organisation.

Common challenges

Internal audit is often seen as a compliance exercise rather than a value-adding function.

Audit plans may not be aligned to key risks, focusing instead on routine or low-impact areas. Findings can be overly technical or not clearly linked to business outcomes, making them difficult to act on.

In some cases, internal audit lacks independence or is too closely aligned to management, reducing its effectiveness. In others, it operates in isolation from risk management and compliance activities.

What good looks like

Internal audit is risk-focused, independent and aligned to the organisation’s priorities.

Audit plans are driven by key risks and strategic objectives. Reviews provide clear, practical insight, with findings that are relevant and actionable.

There is strong engagement with stakeholders, and outcomes are communicated clearly. Actions are tracked and followed through, ensuring that issues are addressed and improvements are embedded.