When should counsel and advisors rely on internal audit’s work?
The answer is not binary. Internal audit can be an efficient and valuable source of evidence, but its report should not replace independent judgment. Counsel should assess the function’s objectivity, competence, methodology and documentation; determine whether the work addresses the question; and decide where reliance, supplementation or independent testing are appropriate.
This framework applies to investigations, risk assessments, remediation, post-settlement reviews, and monitorships. It also helps to explain to regulators, boards, audit committees, and courts why the work performed was sufficient and the reliance judgment was reasonable. The objective is not to prove internal audit to be generally reliable; it is to decide whether particular work is reliable for a particular purpose.
The Benefits of Relying on Internal Audit
Internal auditors know the company: its systems, control owners, reporting lines, data limitations, prior findings and operating realities. That knowledge can shorten an external team’s learning curve and help identify relevant records and personnel.
Reliance can also reduce cost, disruption, and audit fatigue. If internal audit has already tested training, policy implementation, alert handling, access controls, or remediation milestones, counsel can focus independent procedures on higher-risk issues rather than duplicate sound work.
Internal audit may also have faster access to systems, personnel, and historical audits. Those materials can help determine whether a problem is isolated, recurring or part of a broader pattern.
The Risks of Overreliance
The principal risk is independence. Internal audit remains part of the company, and management may influence its budget, staffing, or career paths, even when it reports functionally to the audit committee. Counsel should therefore calibrate reliance carefully when the matter involves senior leaders, sensitive misconduct, or regulatory criticism.
Self-review creates a related risk. Internal audit may have audited, advised on, or validated the controls now under scrutiny. Heavy reliance on its later review may look like the company is marking its own homework.
A clean report proves only what the work tested. It does not by itself establish population completeness, risk-based sampling, sufficient evidence, proper exception clearance, or effective remediation.
Borrowing from Audit Standards
Audit standards provide a useful framework. SEC-approved PCAOB standards emphasize objectivity, competence, the nature and scope of internal audit’s work, and evaluation and testing before reliance.[i] The Institute of Internal Auditors’ (IIA) Global Internal Audit Standards similarly require independence, competence, engagement performance, and quality assessment.[ii]
Counsel Should Ask Five Practical Questions
1. Is internal audit sufficiently objective?
Review reporting lines, access to the audit committee or board, management’s ability to influence scope or reporting, and whether the auditors have a personal or functional stake in the outcome. Objectivity matters most when the work concerns executives, prior audit conclusions, discipline, or potential regulatory criticism.
2. Did internal audit have the right competence?
Assess competence for the work performed. A strong department may still lack the subject-matter expertise, technical skills, or experience required for a particular control, data source, or regulatory obligation.
3. Was the methodology systematic and disciplined?
Review more than the final report: the risk assessment, audit plan, working papers, sampling, retained evidence, exception handling, supervisory review, and issue validation. Consider recent external quality assessments of the function.
4. Does the work adequately address the issue?
Compare internal audit’s procedures with the methodology a third party would perform. Do they cover the same period, population, systems, controls, and criteria? Limit reliance where the objectives differ and consider expanding procedures where risk is present.
5. What independent work remains necessary?
Independent work should increase with risk, judgment, and the consequences of error. Reperform samples, trace evidence to source records, review cleared exceptions, test population completeness, interview internal audit leaders, and compare results with hotline reports, compliance testing, surveillance alerts, discipline records, and regulatory correspondence. The goal is not automatic duplication. It is enough independent work to evaluate quality, resolve material gaps, and support the conclusion.
Where Reliance is Safer and Where it is Not
Reliance is generally safer for objective, evidence-based procedures, such as verifying training completion, policy distribution, certifications, or message retention. Even then, counsel should validate the population, sample selection, and source evidence.
Reliance is less appropriate for high-judgment or high-risk conclusions, including tone at the top, root cause, disciplinary consistency, sustainable remediation, management conduct, or whether control design satisfies a government or regulatory . Internal audit may inform those judgments but should rarely replace independent work.
Document Reliance Judgment
Prepare a reliance memo to create a defensible record. The memo should include and explain:
- What internal audit reviewed and why it was relevant.
- How counsel assessed objectivity, competence, and methodology.
- Which reports, workpapers, and quality-assessment materials counsel reviewed.
- What gaps existed between internal audit’s work and counsel’s work plan.
- What supplemental procedures addressed those gaps.
- Where reliance was appropriate, limited, or inappropriate.
That record will matter if a regulator, board committee, court, or monitor challenges the work or conclusions and the advisor or counsel needs to be able to evidence that it evaluated the function and its work, identified gaps, and performed enough supplemental procedures to support the conclusion.
Conclusion
Internal audit brings company knowledge, reduces cost and disruption, and provides valuable evidence about controls and remediation. However, untested reliance creates risk. A disciplined and thorough framework captures the benefits without sacrificing independence or credibility.
The shorthand is simple: use internal audit, but do not outsource judgment. Trust the work only after testing the function, the people, the methodology, the evidence, and the fit between what internal audit did and what counsel must conclude.
If you have any questions or would like to discuss how we can help, reach out to Jonny Frank or Midori Knowles.
To receive Insights, sign up for our newsletter.
[i] Public Company Accounting Oversight Board, AS 2605, Consideration of the Internal Audit Function ¶¶ .09-.26.
[ii] The Institute of Internal Auditors, Global Internal Audit Standards, Standards 2.1, 3.1-3.2, 7.1, 8.1, 8.4 and 13.1-15.2 (2024).
Disclaimer: The views expressed in this article are those of the author and do not necessarily reflect the views of StoneTurn Group, LLP, Province, LLC, or their affiliates. This article is provided for informational purposes only and does not constitute legal, financial, or other professional advice.
