External audit is a statutory examination by an independent, registered auditor who reports to the shareholders on whether the annual accounts give a true and fair view. Internal audit is a function the organisation sets up for itself to give the board and audit committee assurance on risk management, control and governance, with a scope the board decides. The external auditor can use some of internal audit’s work, but in the UK cannot use internal auditors as members of the audit team.

What is each one for?

The external auditor’s job is defined by statute. Section 495 of the Companies Act 2006 requires the auditor to report to the members on whether the annual accounts give a true and fair view, have been properly prepared under the relevant financial reporting framework and comply with the Act. Section 498 adds duties to form an opinion on whether adequate accounting records have been kept and whether the accounts agree with them, and to say so in the report if not.

Internal audit has no statutory definition in company law. Its remit is whatever the board and audit committee set: commonly reviews of controls, compliance, operational efficiency, fraud risk and specific projects across the whole business, not just the accounts. Its findings go to management and the audit committee, not to shareholders.

Who has to have them?

Every company must have its annual accounts audited under section 475 unless it is exempt, for example as a small or dormant company. Only a person or firm eligible under section 1212, meaning a member of a recognised supervisory body eligible under its rules, can be appointed. See registered auditors and appointing and removing auditors.

Internal audit is driven by governance codes and regulators rather than company law. The UK Corporate Governance Code 2024, which applies to companies listed in the commercial companies or closed ended investment funds categories, asks the audit committee under provision 25 to monitor and review the effectiveness of the internal audit function or, where there is not one, to consider annually whether one is needed and recommend to the board. Provision 26 asks a company without one to explain the absence, how internal assurance is achieved and how this affects the external audit. Many smaller businesses have no internal audit at all and rely on the owners’ review of internal controls.

How do the two compare?

Feature External audit Internal audit
Basis Companies Act 2006 Part 16 Board decision, governance code or sector regulator
Appointed by Members, or directors in specified cases Management or the audit committee
Reports to The members, through the auditor’s report Management and the audit committee
Scope The annual accounts and specified reports Any area of risk, control or governance
Standards ISAs (UK) and the FRC Ethical Standard The function’s own charter and professional standards
Output A public opinion on the accounts Private reports and recommendations
Independence Must be independent of the entity Employees or contractors of the entity, so objectivity rather than independence

How independent does each have to be?

The external auditor must comply with the FRC’s Ethical Standard, which became effective on 15 December 2024. Paragraph 5.45 says a firm shall not provide internal audit services to an entity on whose audit it is engaged, and paragraph 5.46 makes clear this covers outsourcing the whole function, supplementing it in particular areas and occasional ad hoc work. Comments on control weaknesses that arise from the audit itself are a by product of the audit, not internal audit services (paragraph 5.47). For the wider rules, see auditor independence and the FRC Ethical Standard.

Internal auditors cannot be independent in the same sense. ISA (UK) 610 states that neither the internal audit function nor internal auditors are independent of the entity in the way the external auditor must be. What counts for reliance is objectivity. An ACCA technical article notes that objectivity is better supported where internal audit reports to those charged with governance, such as the audit committee, rather than solely to the finance director, and where it has no operational duties outside internal audit.

Can the external auditor rely on internal audit’s work?

Yes, within limits set by ISA (UK) 610, Using the Work of Internal Auditors. Under paragraph 15 the external auditor first evaluates whether the function’s organisational status and policies support its objectivity, its level of competence, and whether it applies a systematic and disciplined approach. Paragraph 18 then requires the external auditor to make all significant judgements and to plan to use less of internal audit’s work, and do more directly, the more judgement is involved, the higher the assessed risk, and the weaker the function’s objectivity or competence. Paragraph 20 requires the auditor to tell those charged with governance how it plans to use internal audit’s work.

Paragraph 11 is the anchor: the external auditor has sole responsibility for the audit opinion, and that responsibility is not reduced by using internal audit’s work.

The UK goes further than the international standard on one point. Paragraph 5-1 of ISA (UK) 610 prohibits using internal auditors to provide direct assistance, meaning internal audit staff working under the external auditor’s direction as part of the audit team. The FRC introduced this prohibition for audits of periods ending on or after 15 June 2014, and for group audits it extends to work by component auditors relied on by the group auditor.

What does the audit committee do with each?

For companies applying the Code, provision 25 gives the audit committee responsibility for monitoring the integrity of the financial statements, reviewing the risk management and internal control framework unless another committee does so, following the FRC’s Audit Committees and the External Audit: Minimum Standard, and overseeing internal audit as described above. Issuers within the FCA’s DTR 7.1 must have a body that, among other things, monitors the effectiveness of internal control, risk management and, where applicable, internal audit regarding financial reporting, and monitors the statutory audit (DTR 7.1.3R).

From financial years beginning on or after 1 January 2026, provision 29 of the Code asks the board to declare in the annual report whether material controls were effective at the balance sheet date. Internal audit typically does much of the testing that supports that declaration, but the declaration is the board’s, not the external auditor’s.

How might the two work together?

Illustration only. A listed company has a small internal audit team reporting to the audit committee chair. During the year it tests purchase ordering controls at three sites and reports two exceptions to the committee. The external auditor evaluates the team’s objectivity and competence, reads the reports and decides to reduce, but not eliminate, its own testing of purchases at those sites, reperforming a sample of internal audit’s tests. Revenue recognition, a significant risk involving judgement, is audited entirely by the external team. The external auditor cannot ask the internal auditors to carry out its own sample testing under its supervision, because direct assistance is prohibited.

What are the common misunderstandings?

  • “Internal audit can replace the statutory audit.” It cannot. An audit exemption depends on size or status under the Companies Act, not on having internal audit.
  • “The external auditor tests all our controls.” ISA (UK) 260 notes that the auditor considers internal control relevant to the accounts only to design appropriate procedures, not to express an opinion on control effectiveness. See audit risk assessment.
  • “Our auditors can run internal audit for us.” The Ethical Standard now prohibits the audit firm from providing internal audit services to its audit clients.
  • “Internal audit reports go in the annual report.” They are private. Only the audit committee’s description of its work and, where relevant, the explanation of having no internal audit function are published.

For the extra rules on the largest and most regulated entities, see public interest entities and audit, and for the external audit process itself, how a statutory audit works.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.