What an internal audit is — and what it explicitly is not

When a business first commissions an internal audit, a reasonable question follows almost immediately: we already have an audit, so what is this one for? It is a fair question, and the answer is not a subtlety. The two exercises have different objects, different readers and different standing.

Different questions entirely

A statutory audit asks whether the financial statements, taken as a whole, present a true and fair view. It is an independent opinion, expressed by a licensed professional, addressed principally to shareholders and to anyone entitled to rely on the published accounts. Its output is an opinion with a signature and defined legal consequence.

An internal audit asks a different question: does this process actually work the way the business believes it works? It examines operations — purchasing, inventory movement, collections, approvals, payroll, access to systems — and reports findings to management. Its output is a set of findings and corrective actions, addressed to the people who can change the process.

One produces an opinion on the accounts. The other produces evidence about the operation. Neither substitutes for the other, and an internal audit never results in a statutory sign-off.

Why the distinction is not pedantry

It matters commercially, because businesses sometimes commission one expecting the other and are disappointed for entirely avoidable reasons. It matters legally, because statutory audit, prescribed certification, statutory valuation and legal opinion are restricted activities that only a licensed professional may perform and sign.

5th Quadrant is not a chartered accountancy firm. We perform internal audit, controls and process work directly. Where an engagement requires restricted work, it is performed and signed by an independently engaged licensed professional, and that separation is maintained deliberately rather than as a formality.

There is a reason the separation has value beyond compliance with it. An internal audit that reports to management and a statutory audit that reports on management are structurally different relationships. Collapsing them weakens both.

What an internal audit actually examines

The scope is set by risk rather than by the shape of the financial statements, which is why two internal audits of similarly sized businesses can look nothing alike. Typically it covers areas where value can leave the business without a corresponding record:

• Purchasing and vendor selection — whether approval actually precedes commitment.
• Inventory movement — whether physical stock and recorded stock diverge, and where.
• Collections and credit — whether terms granted match terms approved.
• Payroll and expenses — whether inputs are authorised by someone who can verify them.
• System access — whether the people who can post entries are the people who should.

Note what these have in common. None of them is primarily a question about the accuracy of a number. They are questions about whether a control exists, operates, and would catch something if something went wrong.

A finding is only useful if it closes

The recurring failure mode of internal audit is not weak fieldwork. It is a report that is received, acknowledged and filed. The findings are accurate, nobody disputes them, and nothing changes — and the following year's review reports substantially the same things.

What prevents this is treating closure as part of the engagement rather than as the client's homework. Each finding carries an agreed corrective action, a named owner and a date; closure is tested rather than asserted; and open items are carried forward visibly instead of being quietly dropped between review cycles.

That is also the honest measure of whether internal audit is worth what it costs. Not the number of findings raised, which mostly reflects how hard someone looked, but the proportion of findings that are still closed a year later.

When it is worth doing

Internal audit tends to earn its place at the point where the promoter can no longer personally see every transaction. Below that scale, direct oversight is genuinely an effective control. Above it, the business is relying on processes it has never tested, and the first real test is usually an incident.

The other common trigger is external: a lender, an investor or a customer asking how controls are governed. That is a poor moment to discover the answer, and a straightforward one to prepare for in advance.