What an internal audit function does

Internal audit is an independent function that gives the board assurance on whether controls, risk management and governance are working. It reports to the audit committee rather than to management, which is what makes its opinion worth having. External audit examines whether the financial statements are fairly stated; internal audit examines whether the business is being run the way the board believes it is.

When organisations bring us in

Usually one of four moments. The audit committee has asked a question nobody can answer with evidence. A regulator or lender expects an internal audit function that does not yet exist. An existing function has grown reactive and is auditing what is easy rather than what is risky. Or the IIA Global Internal Audit Standards, effective from January 2025, have made it clear that the current arrangements no longer meet the definition.

When co-sourcing works better than outsourcing

Co-sourcing keeps your internal audit function in place and adds capability alongside it. Three situations account for most of it. An audit needs a specialist skill the team does not hold, typically technology, cyber, data analytics or forensic. The function is short-staffed against an approved plan and the year will not otherwise be delivered. Or management wants a particular area reviewed from outside the organisation, because the assurance carries more weight when the reviewer has no reporting line into it.

How CLA Emirates delivers internal audit

We work three ways. Full outsource, where we are your internal audit function. Co-source, where we work alongside your existing team. And function set-up, where we build the charter, the risk-based plan and the reporting rhythm, then hand it to your own hire. Every engagement produces a plan tied to your risk register, not a template, and findings framed so the audit committee can decide rather than deliberate.

What an engagement typically covers

  • Internal audit function set-up
  • Risk-based annual audit planning
  • Full outsource
  • Co-source for specialist skills and capacity
  • Quality Assessment Review against the IIA Standards 2024
  • Audit committee reporting