Internal Audit vs. External Audit: What’s the Difference?
Dec 18, 2020 | By Michael Whitmire
When many people hear the word audit, their first thought is of a painful and grueling interrogation to uncover real or imagined misdeeds. But that misleading impression overlooks the foundational role that internal and external auditors play in the world of business. Without these two types of audit, our capital markets would lack integrity, and business operations would be less efficient.
Let’s take a closer look at the jobs of internal auditors vs. external auditors.
Difference Between Internal Auditors vs External Auditors
Both internal and external auditors help companies ensure that their financial reporting agrees with accounting principles, that internal controls are working correctly, and that the company is in compliance with relevant laws and regulations. For both types of auditors, risk assessment is a vital consideration, and a keen understanding of the industry and the company is required. However, how they do their work is a bit different.
Internal auditors, as the name implies, work within an organization as employees, while external auditors are independent of the organizations they audit. Internal audit is a discretionary function within an organization, while external audit may be mandatory. Public companies are required by statute to undergo audits on an annual basis. Lenders and other stakeholders may require audited financial statements as a condition of ongoing financial support.
Let’s take a closer look at each kind of audit.
According to the Institute of Internal Auditors (IIA), “internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.” The purpose of internal audit is to help businesses meet strategic objectives, detect fraud, and improve operations. Internal auditors also ensure that corporate governance is functioning correctly. They may also be called upon to review the budgeting process for special projects, or to review internal processes. Internal auditors also ensure that a company is ready for an external audit.
Depending on the size of the organization, the internal audit function may be performed by a company’s internal audit department or it may be outsourced. The scope of their work is directed by management, but they maintain objectivity and independence by reporting to the audit committee or the board. Their audit reports are shared with the senior management of the area of their examination. These reports point out ways that internal controls can be optimized and ideas for streamlining operations.
Internal audit is generally performed on a continuous basis. Their audit work takes a holistic view of the organization’s financial and non-financial metrics for overall risk management. They ensure that the business practices of a company help a company meet its strategic goals. Their focus is both forwards and backwards: they verify that financial transactions are recorded correctly in a company’s information systems while also looking ahead to ensure the company’s long-term strength.
Like external auditors, internal auditors must comply with auditing standards. Certified Internal Auditors (CIA) must comply with the IIA’s standards. But since no professional designation is required for internal audit, it may be up to the company to spell out and enforce those standards.
The purpose of external audit is to provide assurance to investors, lenders, and other stakeholders that a company’s issued financial statements present the organization’s results in a materially correct and fair manner. In the U.K., this is known as presenting a “true and fair view.” This assurance is provided by verifying that a company is reporting its financial results in accordance with the relevant accounting standards. In the U.S. that means generally accepted accounting principles, or GAAP.
Because their primary responsibility is to outside stakeholders, external auditors must be independent of the companies they audit. In the US, only CPA firms can perform external audits. This means that they must comply with the AICPA’s auditing standards.
Besides performing audits of financial statements, auditing services may also include verification that an organization is in compliance with specific regulations or laws. While the scope of an audit is determined by the purpose, external auditors design their audit work programs according to their assessment of risk within the organization.
Unlike internal auditors, external auditors perform the bulk of their work at the end of the year, looking backwards to verify that an organization’s financial records correctly reflect the events of the past. However, that exclusive year-end focus is changing. Some audit firms are switching to a continuous focus, with several mini-audits performed throughout the year.
When the auditors have completed their work, they provide a report to management and other stakeholders. The content and format of these external audit reports is specified by the auditing standards. At an exit conference with management, the auditors may discuss the deficiencies in a company’s internal controls and may also provide management with suggestions for improving the business. External auditors can suggest changes but are not allowed to implement those changes as that would impair their independence.
Internal vs. External Audit Comparative Table
This chart summarizes the main differences between internal and external audit.
|Internal Audit||External Audit|
|Purpose||Review of financial reporting, operations, processes, internal control systemsrisk management, corporate governance, and fraud detection||Review of financial statements or other compliance matter|
|Relationship to Company||Employee||Independent|
|Focus||Continuous improvement and meeting strategic goals||Fair reporting of financials or other compliance matter|
|Audience||Senior management||External stakeholders|
|Perspective||Historical and the future||Primarily historical|
|Timing||Continuous||End of year or quarter|
|Professional Designation||None required||Performed by CPA firm and overseen by CPA|
In summary, internal audit helps to improve companies from the inside, while external audit ensures that what they present to the outside world reflects what really happened. Both types of audit keep the engine of our economy running efficiently and accurately.