Internal audit
Also called third line of defence
Internal audit is a firm's independent function that tests whether risk management, controls and governance work as intended. It reports to the board audit committee, not to the business it reviews. In financial services it is often called the third line of defence, after business management and the risk and compliance functions.
How it works
The chief audit executive builds a risk-based audit plan each year, approved by the audit committee. Auditors review processes such as onboarding, transaction monitoring or IT change control. They test samples, interview staff and rate findings by severity. Management agrees actions and deadlines, and internal audit tracks them to closure.
Supervisors rely on internal audit to tell them whether a bank's controls work. A strong function can reduce the need for regulator-ordered reviews. Weak audit coverage of financial crime or IT is a common supervisory finding. The Institute of Internal Auditors' Global Internal Audit Standards have applied since 2025.
The rules
Sets 15 principles and standards for independence, governance, resource management and performance of internal audit.
Internal audit functions worldwideSets 20 principles requiring banks to have a permanent, independent internal audit function reporting to the board or audit committee.
Banks and banking supervisorsGives the audit committee responsibility for monitoring and reviewing the effectiveness of the internal audit function.
UK companies listed in the commercial companies or closed-ended investment funds category, on a comply or explain basisCommon questions
What is the difference between internal and external audit?
Internal audit is part of the firm and reviews controls and risk across the whole business for the board. External audit is an independent firm that gives an opinion on the financial statements to shareholders.
Who does internal audit report to?
The chief audit executive reports functionally to the audit committee of the board, which approves the audit plan and budget. Administrative reporting usually goes to the chief executive, which protects independence from the areas being audited.
What is the third line of defence?
It is internal audit's place in the three lines model. The first line is business management that owns risks. The second line is risk and compliance, which sets policy and oversees. The third line gives independent assurance on both.
Can internal audit be outsourced?
Yes, in whole or in part. Many firms co-source specialist audits such as IT or model risk. The board remains responsible, and supervisors expect the firm to keep enough in-house knowledge to oversee the provider.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostInside the Role of an Internal Auditor: Oversight, Risk, and GovernanceRead the article →RegTech Post5 Technology Tools That All Internal Auditors Should Be UsingRead the article →
