Internal audit strategy
Definition
Internal audit strategy
Internal audit strategy sets what the audit function will examine over a multi year cycle, in what order, and with what people. It serves the board by testing whether controls work, while external audit serves shareholders by testing the financial statements.
A strategy is not an audit plan for next quarter. It is the multi-year view that decides which risks get looked at, how often they recur, and what the function needs in order to look at them properly.
It is also where the function decides what it will not cover. An audit universe without priorities turns into a list nobody finishes — and a board learns nothing from a backlog.
Key takeaways
- Internal audit tests whether controls work; external audit tests the financial statements.
- The strategy covers a multi-year cycle, not a single engagement.
- It names what will not be audited — the harder half of the job.
- Resourcing, skills and the reporting line belong in the strategy, not in the annual plan.
How it works
You start from an audit universe: every process, system and third party the organisation depends on. Each entry gets a risk score, the scores set a rotation, and the rotation becomes a cycle of engagements running across three to five years.
| Element | The decision it records |
|---|---|
| Audit universe | What could be audited at all |
| Risk ranking | What gets audited first |
| Cycle length | How often each area comes round again |
| Resourcing | Which skills are hired, trained or bought in |
| Reporting line | Who the function answers to |
| Assurance map | Which risks somebody else already covers |
Risk ranking is where most strategies go soft. Score each area on business risk and on the damage a control failure would do — then defend that ranking in front of the audit committee.
Third parties only enter the universe if the contract lets them. A right to audit clause has to exist before an engagement can be scheduled, which makes the strategy partly a procurement problem.
Resourcing includes technology. Software audit tools test full populations rather than samples, and that changes how much ground a small team can honestly claim to cover in a year.
Control frameworks move, and a strategy written against an old one ages badly. The 2025 revision of the Government Accountability Office’s Green Book supersedes the 2014 edition and adds requirements covering fraud, improper payments and information security.
Public companies carry a second driver. Under section 404 of the Sarbanes-Oxley Act, annual reports must contain an assessment of internal control effectiveness for financial reporting, with the audit firm attesting unless the issuer is exempt.
Independence is a structural choice, not a personality trait. The head of internal audit reports to the audit committee for all assurance work, and to the chief executive only for administration and budget.
Write the strategy so a reader can see the trade. For every area pulled forward, name the area pushed back, because a cycle that only ever adds coverage is a wish list with a cover page.
Examples
What a strategy covers depends on what the organisation actually depends on. Three settings show how differently the universe is drawn, in banking, in outsourced operations and in a growing mid-market firm.
Banking. A retail bank splits its cycle so credit, anti-money-laundering controls and technology change each recur annually, while lower-risk areas such as facilities come round once in four years.
Regulators effectively set part of that rotation. Where a supervisor expects annual coverage of a named control area, the strategy records it as a fixed commitment rather than pretending the ranking produced it.
Outsourced operations. Firms using quality assurance outsourcing still own the control. The provider runs the checks, and the audit strategy tests whether those checks are honest, representative and acted upon.
In a contact centre, call auditing is a quality routine run on individual calls by the operation itself. The audit strategy decides something larger: whether the quality function as a whole gets examined, and when.
A growing mid-market firm. A company crossing into regulated territory writes its first strategy around three questions. What must be assured, what can wait, and whether the skills exist in house to do either.
The third question is usually the one that reshapes the rest. A strategy promising deep technology audits with no technology auditors is a plan to miss, and the board will read the misses as a control weakness.
Coverage claims are where strategies get embarrassing. Saying an area is audited every three years means nothing if the last two cycles were deferred — and audit committees now ask for the deferral history by name.
Public bodies face the same arithmetic with less room to move. Statutory coverage obligations consume the cycle first, and whatever remains is the only discretionary capacity the strategy can actually allocate.
Related terms
- Financial controller: owns the accounting controls that internal audit then tests.
- Quality control analyst: checks output against a standard inside the process, rather than over it.
- Business risk: the exposure that drives which areas rank first in the cycle.
- Right to audit clause: the contractual permission that puts a supplier inside the universe.
- Call auditing: a quality routine on individual calls, not an assurance strategy.
FAQ
What is the difference between internal and external audit?
Internal audit reports to the board and tests whether controls are designed and operating well. External audit reports to shareholders and gives an opinion on the financial statements.
How long should the audit cycle be?
Three to five years is common, with the highest-risk areas pulled forward to annual coverage. The cycle length is a resourcing decision as much as a risk one.
Who approves the internal audit strategy?
The audit committee, on the recommendation of the head of internal audit. Management can comment on it, but management approving its own assurance plan defeats the purpose.
Can internal audit be outsourced?
Yes, in whole or in part, and co-sourcing specialist skills is common. Independence survives only if the provider reports to the committee rather than to the function being audited.
How often should the strategy be revisited?
Annually at minimum, and immediately after a major acquisition, system replacement or regulatory change. A strategy that survives three years untouched is usually being ignored.
Shortlist assurance and finance providers in the Outsource Accelerator directory before deciding to build the function in house.
Independent
