The Internal Audit Role
This domain tests the distinction between compliance monitoring and internal audit, and how independent assurance reaches the board.
Independence and reporting
Internal audit is the third line. It should report functionally to the audit committee and have unrestricted access to records and people. It must not take management decisions or operate controls it audits. Its plan should be risk-based and cover compliance processes, not only financial statements.
What audit adds
Audit evaluates the design and effectiveness of controls, including the compliance function's own monitoring. It issues findings with ratings, root causes, and agreed actions, then follows up.
Worked example
Internal audit finds that compliance monitoring reviews were performed but not documented, and that two high-risk findings remained open past their due date. Audit reports this to the audit committee and tracks remediation. Reasoning: the issue is assurance and governance, not just filing; audit tests whether the second line's process actually works.
Traps that cost marks
- Saying internal audit 'does compliance'.
- Letting the compliance officer audit their own monitoring.
- Treating an audit finding as closed when management says it is fixed.
- Placing internal audit under the business head it audits.
Audit provides independent assurance; compliance provides second-line oversight. The two should coordinate without merging.