The right type of internal audit depends on the organisation’s needs and goals. The main types are:
The seven types of internal audit
| Type | What it examines |
|---|---|
| Financial audit | Accuracy, completeness and compliance of financial records |
| Operational audit | Efficiency and effectiveness of processes and use of resources |
| Compliance audit | Adherence to laws, regulations, policies and industry standards |
| IT audit | Security, reliability and compliance of systems and infrastructure |
| Integrated audit | Financial, operational, compliance and IT elements in one review |
| Risk-based audit | The organisation’s most significant risks and the controls over them |
| Performance audit | Whether a programme or function meets its objectives and gives value for money |
Guidance for management
As a starting point, choose a risk-based audit: it focuses effort on the risks that matter most and helps prioritise resources. Add a compliance audit to protect the organisation from penalties and reputational damage. An integrated audit is valuable for a complete view of the control environment and how different parts of the business affect one another.
The best approach is agreed jointly by management and internal audit, based on the organisation’s goals and risk profile.
