Internal audit and external audit share a word and almost nothing else. One is a standing function inside an organization, accountable to its board. The other is an engagement performed by an outside accounting firm for the people who read the financial statements. They report to different parties, run on different rulebooks and finish with different documents, which is why a client asking for "an audit" is often asking for the wrong one.
Internal Audit vs External Audit, Side by Side
Seven questions separate them.
| Question | Internal audit | External audit |
|---|---|---|
| Who it answers to | The board and senior management | The governing body that engages it, for the benefit of the financial statement users |
| What it produces | An engagement conclusion, plus tracked action plans | An opinion, in a written report |
| Which rulebook | The Global Internal Audit Standards | PCAOB standards or US GAAS |
| What independence means | Position inside the entity, plus objectivity | The firm's independence from the client |
| Who requires it | A board mandate, a law, a regulator or a listing standard | A filing rule, a statute or a contract |
| When it runs | A risk-based plan, reassessed at least annually | An engagement fixed to a period that has closed |
| What it may examine | Governance, risk management and control processes | The financial statements |
Sources: the Global Internal Audit Standards, the AICPA's AU-C sections and 17 CFR 210.1-02.
Who Each Audit Answers To
Internal audit answers inward. The Institute of Internal Auditors puts its purpose this way: internal auditing strengthens the organization's ability to create, protect and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight, and it is most effective when the function is independently positioned with direct accountability to the board (Global Internal Audit Standards). Board in that sentence is the standards' own term: the highest-level body charged with governance, which may be a board of directors, an audit committee, a board of governors or trustees, a group of elected officials, or another body with authority over the relevant governance functions. Where an organization has more than one governing body, it means the one authorized to give the internal audit function its authority, role and responsibilities.
An external audit answers outward. Its purpose is to provide financial statement users with an opinion by the auditor on whether the financial statements are presented fairly, in all material respects, in accordance with an applicable financial reporting framework, which enhances the degree of confidence intended users can place in them. The statements themselves stay management's work, prepared and presented by management with oversight from those charged with governance (AU-C 200 .04 and .05).
Where the client is an issuer, in the sense the Sarbanes-Oxley Act gives that word, the reporting line is fixed by statute. The audit committee, in its capacity as a committee of the board of directors, is directly responsible for the appointment, compensation and oversight of the work of any registered public accounting firm the issuer employs to prepare or issue an audit report or related work, and that responsibility includes resolving disagreements between management and the auditor about financial reporting. Each such firm reports directly to the audit committee (15 U.S.C. 78j-1(m)(2)).
A client who wants a standing, repeating look at whether a control is working is describing the internal kind. An external auditor reaches controls too, in an audit of internal control over financial reporting integrated with the audit of the financial statements, and the auditing standards are adapted to fit that engagement (AU-C 200 .02). A lender, an investor or a buyer who wants comfort on the numbers is asking for the other one.
What Each One Produces
What the external auditor produces is an opinion. The auditor should form an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework, and express it clearly through a written report. An unmodified opinion, the clean one, is what the auditor expresses on concluding that the statements are presented fairly in those terms (AU-C 700 .09, .10 and .12).
Internal audit issues no opinion on the financial statements. It issues a conclusion. Internal auditors must develop an engagement conclusion that summarizes the engagement results relative to the engagement objectives and management's objectives, and an assurance engagement conclusion must include their judgment on the effectiveness of the governance, risk management or control processes of the activity under review, including an acknowledgment of when those processes are effective (Standard 14.5).
That conclusion goes to the people who can act on it. The chief audit executive, the role responsible for managing the function, must communicate the results of internal audit services to the board and senior management periodically and for each engagement as appropriate (Standard 11.3).
Internal audit's work also continues past the report. Internal auditors must confirm that management has implemented the auditors' recommendations or management's action plans, following an established methodology that includes inquiring about progress, performing risk-based follow-up assessments and updating the status in a tracking system (Standard 15.2). The anatomy of a single finding, and what the standards actually say about the 5 C's, is set out in internal audit co-sourcing.
Which Rulebook Governs Each
The word audit points at two different books, and a client's request letter usually uses one word for both. Internal audit work is performed under the Global Internal Audit Standards. External audit work has two possible books, and the choice turns on whether the client is an issuer, a term that rule takes from the Sarbanes-Oxley Act. That definition covers three cases: a company whose securities are registered under the Securities Exchange Act, one required to file reports under that Act, and one that has filed a registration statement that has not yet become effective and has not been withdrawn (15 U.S.C. 7201(7)).
For issuers, an audit means an examination of the financial statements by an independent accountant in accordance with the standards of the Public Company Accounting Oversight Board, the PCAOB. For entities that are not issuers, it means an examination in accordance with either PCAOB standards or US generally accepted auditing standards, as specified or permitted in the Commission's rules and forms applicable to those entities (17 CFR 210.1-02(d)). Behind a private company audit with no filing at all, generally accepted auditing standards are the book, issued as Statements on Auditing Standards and codified into AU-C sections (AU-C 200 .02).
What Independence Means on Each Side
Both sides use the word and neither means the same thing by it. Internal audit independence is structural, and the standards put the board in charge of it. The chief audit executive must confirm to the board the organizational independence of the function at least annually, including any incidents where independence may have been impaired and the safeguards used. Under the same standard the board holds that direct reporting line, authorizes the appointment and removal of the chief audit executive, and requires the role to be positioned at a level where management cannot interfere (Standard 7.1).
Objectivity is the personal half: in all aspects of internal audit services, internal auditors must apply an impartial and unbiased mindset and must manage potential biases such as self-review and familiarity (Standard 2.1).
For the external auditor the word is about the firm's relationship with the client, not its place on an org chart. The AICPA Code of Professional Conduct defines independence as two elements: independence of mind, the state of mind that permits a member to perform an attest service without being affected by influences that compromise professional judgment, and independence in appearance, the avoidance of circumstances that would cause a reasonable and informed third party who has knowledge of all relevant information, including the safeguards applied, to reasonably conclude that the integrity, objectivity or professional skepticism of the firm or of a member of the attest engagement team is compromised (AICPA Code 0.400.23).
So an entity can employ its internal auditors and still call the function independent, while an audit firm that took a seat inside the same entity could not call itself independent of it. What happens when one firm tries to hold both roles for the same client is a separate rulebook, written out in internal audit co-sourcing.
Who Requires Each One to Exist
An internal audit function exists because someone with authority creates it. The chief audit executive must give the board and senior management the information necessary to establish the internal audit mandate, which is then documented in an internal audit charter the board approves. Where a jurisdiction or an industry prescribes the mandate wholly or partially in laws or regulations, the charter must include those legal requirements (Standard 6.1). A stock exchange can require the function outright, and the listing standard that does is quoted in internal audit co-sourcing.
An external audit is almost always forced from outside the company. A registrant has no discretion. Audited balance sheets must be filed for the registrant and its subsidiaries consolidated, and for its predecessors, as of the end of each of the two most recent fiscal years (17 CFR 210.3-01(a)). Everywhere else the requirement sits in a program rule, a statute or a document somebody already signed, and choosing the level that source names is its own decision, worked through in audit vs review vs compilation.
What Each One Covers, and When
Internal audit runs on a plan rather than on a season, and that plan can reach anything carrying risk. The chief audit executive must base it on a documented assessment of the organization's strategies, objectives and risks, performed at least annually, and keep it dynamic and updated as the business changes. The same standard says the plan must specify services supporting the evaluation and improvement of governance, risk management and control processes, and must consider coverage of information technology governance, fraud risk, the effectiveness of the compliance and ethics programs and other high-risk areas (Standard 9.4). The board approves the plan, and every significant change to it.
An external audit attaches to a period that has closed, and its subject is the statements. The standard is written for an audit of a complete set of general purpose financial statements, prepared in accordance with a framework designed to meet the common financial information needs of a wide range of users (AU-C 700 .02 and .10).
So a question about operational efficiency, or about whether an ethics program works, sits outside the external audit's subject. That is how a clean opinion on the statements and an open internal audit finding can live in the same organization in the same year.
What Stays With the Firm in Either Audit
Both audits create work a firm cannot delegate and work it can, sorted by work type rather than by seniority. The acts that carry the opinion stay with the engagement team, and the audit support work that can move to an outside preparer is set out in outsourced audit support. The limits on buying outside help for an internal audit function sit in internal audit co-sourcing and co-sourcing.
Accountably is offshore accounting and tax staffing for US CPA, EA and accounting firms. We place trained offshore accountants and tax preparers inside the firm, on its own software and SOPs, with the signature, the opinion and the final judgment staying with the firm. Our scope is accounting and tax work rather than audit or internal audit fieldwork. Since 2022 that has meant 20+ US firms and 30+ placements.
The way in is deliberately small. A Free 40-Hour Proof Pilot puts a fixed block of your own representative work through the offshore team and your review chain, so your reviewer grades real output before a client file is committed. If a placement is not the right fit inside the first 30 days, the 30-Day Fit Guarantee replaces them free.
Don't trust us. Test us.