control, and governance
How Do I ... Distinguish Internal and External Auditing?
Internal auditors and external auditors each play an important role in the governance of an organization. Both groups have mutual interests regarding the effectiveness of internal financial controls, and both adhere to ethical codes and professional standards set by their respective professional bodies. Additionally, both types of auditors operate independently of the activities they audit, and they're expected to have extensive knowledge about the business, industry, and strategic risks faced by the organization they serve. Yet, with all of their similarities, internal auditing and external auditing are two distinct functions that have numerous differences.
The IIA defines internal auditing as "an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."
In contrast, external auditing provides an independent opinion of a company's financial statements and fair presentation. This type of auditing encompasses whether the statements conform with Generally Accepted Accounting Principles, whether they fairly present the financial position of the organization, whether the results of operations for a given period of time are represented accurately, and whether the financial statements have been affected materially.
Internal auditors represent an integral part of the organization - their primary clients are management and the board. Although historically internal auditors have reported to the chief financial officer or other senior management staff, the trend today is for internal auditing to report directly to the audit committee.
Conversely, external auditors are not part of the organization, but are engaged by it. Their objectives are set primarily by statute and by their main client, the board of directors.
MANDATORY VERSUS VOLUNTARY
In general, internal audit functions are not mandatory for organizations. Instead, their installment is left up to individual organizations' discretion.
An external audit is legally required for many companies, particularly those listed on a public exchange. External audits of some government agencies are also legislated, requiring government auditors to submit the audit report to their respective legislature.
QUALIFIED AND KNOWLEDGEABLE
The necessary qualifications for an internal auditor rest solely on the judgment of the employer. Although internal auditors are often qualified as accountants, some are qualified engineers, sales personnel, production engineers, and management personnel who have moved through the ranks of the organization with a sound knowledge of its operations and have garnered experience that makes them aptly qualified to perform internal auditing.
External auditors are required to understand errors and irregularities, assess risk of occurrence, design audits to provide reasonable assurance of material detection, and report on such findings. In most countries, auditors of public companies must be members of a body of professional accountants recognized by law.
Adapted from "Two Sides of Auditing" by Lal Balkaran (Internal Auditor, "Back to Basics," October 2008).
COMMENT ON THIS ARTICLE
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.