How to Strengthen an Internal Audit Function That Is Not Working

Five faults, in the order they matter.

1. Reporting line

If internal audit reports to the CFO, it cannot examine finance.

The function must report to the owner, the board, or an audit committee. Not to a department it audits.

This single fault explains most underperforming internal audit functions, and no amount of better fieldwork compensates for it.

2. Scope set by the wrong person

If management chooses what gets audited, management chooses what does not.

The plan should be set by whoever the function reports to, informed by a risk assessment rather than by convenience.

Look at your last two years of internal audit reports. If nothing sensitive appears, scope is being managed.

3. No follow-up

Findings raised, agreed, and never implemented. Then raised again next year.

The fix is mechanical. Every finding gets an owner and a date, and closure is verified by someone other than the person who fixed it.

If your last report repeats findings from the previous one, this is your problem, and it is not the auditor's fault.

4. Auditing compliance instead of risk

Weak functions test whether forms were filled in. Strong ones test whether money could leave without authority.

Compliance testing is easy to plan, easy to complete and produces findings nobody cares about. It is the safe way to look busy.

Ask what the last report actually found. If it is documentation gaps and no financial exposure, the function is testing the wrong things.

5. Wrong skills for the data

Full population testing needs someone who can query a ledger, not only read one.

A function that still samples 25 items by hand is working at a fraction of what is available to it. Four data checks over a full ledger, thresholds, duplicates, supplier bank details matching employees, and journal timing, will find more in an hour than a week of manual sampling.

How to tell whether it is working

Three questions.

What did it find in the last twelve months that you did not already know? What changed as a result?
Has it examined anything that was uncomfortable?

Three vague answers means you are funding documentation, not assurance.

The minimum viable structure

Reports to the owner or board. Plan set annually against a risk assessment. Findings tracked to closure with named owners. Full population data testing on financial processes. One uncomfortable area per year.

That is the whole structure. Everything else is refinement.

Where we fit

We review existing internal audit functions and run co-sourced work where the skills gap is data rather than judgment.