Internal audit, external audit or a specific investigation?
Choose the engagement by the question it must answer and who will use the findings.
| Requirement | Appropriate focus | Important boundary |
|---|---|---|
| Check whether purchasing approvals work | An internal audit of authority limits, orders, invoices and selected payments. | Management continues to operate and approve the purchasing process. |
| Find out whether earlier recommendations were completed | A follow-up review of the agreed actions and implementation evidence. | A statement that an issue is closed is not sufficient evidence. |
| Obtain an opinion on the financial statements | An external financial-statement audit with the appropriate appointment. | An internal audit report does not provide that opinion. |
| Examine suspected deliberate misconduct | A separately defined investigation with suitable expertise and reporting arrangements. | Agree evidence handling and legal involvement before expanding routine testing. |
Reviewing work we also perform requires an objectivity assessment before accepting the engagement.
We define the period, access and reporting arrangements before testing controls, then report evidenced findings and actions agreed with management.
Select the processes that matter most
A review can focus on a single process or cover several connected areas. We consider the size of transactions, opportunities for error, previous incidents and recent organisational changes when agreeing priorities. The work may combine interviews, process walkthroughs, document inspection and testing of selected transactions. The test population and period are defined in advance, with scope changes recorded when new information affects the work.
The IIA guidance on risk-based planning supports prioritising internal audit work around an organisation’s risks. The plan should therefore reflect your business rather than repeat the same checklist regardless of what has changed.
Make findings specific enough to act on
We distinguish a missing policy from a control that exists but is not followed. A useful finding sets out the expected practice, what the evidence shows, the consequence and the reason the problem occurs where this can be established. Management can respond before the report is finalised. Recommendations are discussed for practicality, and agreed actions identify an owner and target date. Follow-up work checks evidence of implementation rather than accepting a statement that the issue is closed.
Protect the review’s objectivity
Reporting arrangements and potential conflicts are assessed before acceptance. The Global Internal Audit Standards emphasise objective work and appropriate positioning of the internal audit function. Where we also provide another service, we assess whether that work creates a conflict and agree an appropriate separation or decline the overlapping review.
Management remains responsible for operating controls and implementing changes. Internal audit does not provide a statutory opinion on the financial statements, guarantee that every fraud will be found or replace a specialist investigation. If a concern suggests deliberate misconduct or requires legal action, the engagement must be reassessed and the appropriate expertise involved.
Documents and records to prepare
Tick the records you already have. The final request depends on your entity, the period and the work agreed. Please do not send financial records through this website.
0 of 7 items checked
Related reading: UAE accounting records: how long to keep them and how to organise the archive.
How the work starts
Set the mandate
We agree the purpose, reporting recipient, independence arrangements and access, together with the processes and periods to be examined.
Understand and test
We document how the process operates and perform the agreed tests. Evidence gaps and changes to the scope are discussed as they arise.
Discuss findings
We verify factual accuracy with relevant managers, explain the risks and develop recommendations or action plans with clear ownership.
Report and follow up
The final report records conclusions and responses. Where included, follow-up checks whether the agreed changes have been implemented and are operating.
What affects the scope and fee?
- Number of processes, entities and locations
- Complexity of systems and risk concerns
- Extent of testing and availability of evidence
- Reporting and oversight requirements
- Follow-up or recurring-programme scope
We set out the deliverables, responsibilities and fee in the proposal. Work outside that scope is discussed before it is added.
Internal audit FAQs
How is internal audit different from external audit?
Internal audit examines selected risks, processes and controls for management or those overseeing the organisation. An external financial-statement audit has a different purpose and reporting framework. One does not automatically replace the other. We establish the intended users and expected output before deciding which engagement fits the requirement.
Can we commission one targeted review?
Yes. You may want to examine a process such as purchasing, expenses or credit control before considering a wider programme. The scope should define the concern, period, locations and evidence available. A focused review can be useful, provided readers understand which related processes have not been assessed.
Will the review detect every fraud or error?
No review should be described as a guarantee that all misconduct or errors will be detected. Testing has a defined scope and evidence limitations. If the purpose is to investigate a particular allegation, that should be stated at the outset so the required forensic, legal and confidentiality arrangements can be considered.
Who should receive the report?
The reporting line should allow findings to reach people with the authority to address them and provide appropriate oversight. We agree the recipient and escalation arrangements before fieldwork. Process owners need enough information to respond and implement actions, while sensitive material may require more restricted circulation.
Can the same team review work it previously performed?
That creates an objectivity concern which must be assessed before accepting the review. We identify prior responsibilities and any conflict with the proposed assurance work. The response may require separation, a different arrangement or declining that part of the engagement. The scope should never imply independence without considering these facts.
What happens after the report is issued?
Management owns the agreed changes. Where follow-up is included, we request evidence and assess whether the action addresses the finding. An action may be implemented but still fail to resolve the underlying problem. The follow-up report distinguishes completed, overdue and partially effective actions so oversight can continue.
Sources and further reading
Original page research: 5 October 2026. Service comparison and preparation checklist updated: 9 October 2026. Requirements can change; check the linked authority guidance for the latest position.
How we use sources
