Function of internal and external auditors

Role of internal auditors  

Internal auditors focus on ensuring that the systems and processes of an organisation are working well. Internal auditors act as consultants to the organisation providing assurance on the organisations risk management governance and internal control processes.

Internal auditors have to be independent from the organisations they evaluate and report to the highest level in an organisation, the senior managers and governors.

The process of internal auditing normally consists of:

  • Research – Researched is gathered on a range of information to enable the review of a business in a particular section. Eg what activities occur?
  • Planning – Involves determining and discussing the priorities and objectives after the review with managers.  Eg Setting targets, outputs and deadlines.
  • Providing Assurance
  • Action

Role of external auditors

External auditors concern themselves with examining annual reports of an organisation that it has no involvement with. Emphasis is on the external auditor not playing any part in the daily operations of the organisation.

Unlike internal auditors, external auditors express their opinions on whether the information presented in financial statements, reflect those in the financial position at any date in time. For example, are the details of the organisations income and liabilities properly recorded in the income statement.

In a case were the external auditor identifies a significant issue with the accounts, they will provide the managers in the company with an “audit management letter” which records any issues and how they should be resolved. External auditors are important towards promoting confidence and trust in financial information.

The key differences between these two types of auditors are:

Internal Auditor External Auditor 
Helps as a measure of comparison in a scheme of merger through measuring the asset backing. Inspect the financial accounts.
Audit role is much broader (eg They might have to consider the strategic risk involved in implementing a new product).


The scope of auditing has increased significantly over the last 20 years. Once a term applied in the main to financial audits carried out by external, independent auditors who met government requirements for experience, education and training or by qualified company (internal) auditors it is now applied to a wide range of inspection and verification activities:

  • Quality audits;
  • Medical audits;
  • Health and Safety audits;

To name but a few. Not surprisingly the result has been an interest in and study of the techniques, processes and management of audits so as to develop a body of knowledge and good practice guidelines that can be applied to a wide range of audit subjects.

While many of the new areas of audit require specialist input, internal auditors may often find themselves as a member of such a team and there are occasions when internal audit will want to include these areas in its remit, subject to ethical concerns such as patient confidentiality.

For our purposes operational auditing can be defined in a number of ways:

  • The audit of operating units, for example subsidiaries or plants and the scope of the audit may be restricted to financial controls or not.
  • The audit of accounting and financial controls in the functional areas of business such as marketing or distribution.
  • The audit of any part of the business where the audit objective is a review of the effectiveness and efficiency with which management is achieving its objectives.

The scope of an operational audit can be restricted to the internal controls, operational as well as financial and accounting or it can cover subjects such as policies, procedures, quality of management and so on.


Should the scope of the audit cover only internal controls or should it cover a general review of operations? Bear in mind that management is responsible not just for implementing internal controls but also for planning, organising, staffing and leading. Weaknesses in these areas of management performance can lead to poor internal control. Even if they do not it is more than possible that weaknesses will impede attainment of business objectives.

In addition the audit plan will need to decide which activities will be audited. While the main focus will be on those most closely related to the attainment of the business’s objectives, such as production or sales, the supporting functions such as personnel should also be audited from time to time.