Skip to content

Internal Audit

What is Internal Audit?

An independent, objective assurance activity within an organisation that evaluates the effectiveness of risk management, controls, and governance processes.

Risk Management

Related terms

Nonconformity

Frameworks that govern internal audit

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →COBIT 2019View framework →

What the standards actually require on internal audit

Requirements naming internal audit across 6 standards, quoted from the control text.

OCC Heightened Standards (12 CFR Part 30, Appendix D)15 controls

Internal audit, which in addition to Appendix A should ensure the framework complies with the Guidelines and suits the bank's size, complexity and risk profile, should establish and adhere to talent management processes that comply with II.L.

occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(h) · II.C.3.(h) Internal audit: Talent management processes (II.L) →
FFIEC IT Examination Handbook13 controls

The board and senior management engage internal audit or other independent, qualified personnel or third parties to review AIO functions and validate the design, implementation and operational effectiveness of controls, with auditors independent of the functio...

ffiec-it-examination-handbook::AIO-II.D · II.D Internal Audit, Independent Reviews, and (Architecture, Infrastructure, and Operations) →
ISAE 3402 - Assurance Reports on Controls at a Service Organisation9 controls

To use specific internal audit work the service auditor evaluates it and performs procedures on it to determine its adequacy for the auditor's purposes.

isae-3402-assurance-reports-on-controls-at-a-service-organisation::3402.34 · ISAE 3402 paragraph 34: Using the Work of the Internal Audit Function →
BRCGS Global Standard for Food Safety Issue 95 controls

Internal audits must be performed by competent auditors with suitable training who are independent of the work being audited.

brcgs-global-standard-for-food-safety-issue-9::3.4.2 · 3.4.2 Internal audits by trained, competent, independent auditors →
ISO 14004:20164 controls

Guidance: internal audits should take place at planned intervals to tell management whether the system meets the arrangements planned for it and is properly implemented and kept up, and to identify improvement opportunities.

iso-14004-2016::9.2 · Internal audit →
ISO 37003:20254 controls

Run internal audits at planned intervals to learn whether the fraud control system conforms to the organization's own requirements and to this guidance and whether it is effectively implemented and maintained.

iso-37003-2025::9.2.1 · General: internal audit →

Questions people ask about internal audit

What is Internal Audit?
An independent, objective assurance activity within an organisation that evaluates the effectiveness of risk management, controls, and governance processes.
Why is Internal Audit important for compliance?
Internal Audit is a key concept in Risk Management. Understanding internal audit helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to Internal Audit?
Key concepts related to Internal Audit include Nonconformity. Understanding these interconnected concepts provides a more comprehensive view of Risk Management requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Internal Audit?
Internal Audit appears in the requirement text of OCC Heightened Standards (12 CFR Part 30, Appendix D), FFIEC IT Examination Handbook, ISAE 3402 - Assurance Reports on Controls at a Service Organisation, BRCGS Global Standard for Food Safety Issue 9, ISO 14004:2016. Across these standards we have identified 50 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Internal Audit?
Explore our compliance framework pages to see how internal audit applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Internal Audit applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.