How to set up an internal audit function: a step-by-step guide

Knowing how to set up an internal audit function properly matters more in 2025 than it did a year ago. The Institute of Internal Auditors’ Global Internal Audit Standards became effective on 9 January 2025, and functions are now expected to conform with them.¹ The Standards place specific responsibilities on the board and senior management as well as on the chief audit executive (CAE), whether internal auditors are employed directly, contracted through an external service provider, or both.² In the UK, the Chartered IIA’s Internal Audit Code of Practice also took effect in January 2025.³

This guide sets out a practical sequence for establishing internal audit from a standing start: when an organisation needs it, the five decisions that shape it, an illustrative plan for the first 180 days and the mistakes to avoid. It is written for finance directors, audit committee chairs and owners who have to make those decisions, often before a head of internal audit is in post.

When an organisation needs internal audit

Even for companies that apply the UK Corporate Governance Code 2024, internal audit is a matter of judgement rather than an absolute rule. Provision 25 asks the audit committee to monitor and review the effectiveness of the internal audit function or, where there is not one, to consider annually whether there is a need for one and make a recommendation to the board. Provision 26 adds that, where there is no function, the annual report should explain the absence, how internal assurance is achieved and how this affects the work of external audit.⁴ The 2024 Code applies to accounting periods beginning on or after 1 January 2025, except Provision 29 on the board’s review and declaration on material controls, which applies to periods beginning on or after 1 January 2026.⁴

Large private companies are not bound by that Code, but the FRC’s Wates Principles are aimed at companies not subject to a formal governance code. Principle Four (Opportunity and Risk) expects the board to establish an internal control framework with clearly defined roles and responsibilities for those involved.⁵ Internal audit is the usual way a board obtains objective evidence that such a framework works.

In practice, the question tends to become pressing when one or more of these is true:

• The business has grown faster than its controls: new sites, countries, systems or acquisitions.
• Owners or founders no longer see every significant transaction, or ownership and management are separating, for example on a generational transition or the arrival of non-family executives.
• Lenders, investors, regulators or major customers are asking how the board gets assurance over key risks.
• There has been a fraud, a significant control failure or a near miss.
• The organisation is preparing for investment, sale or listing.
• The board cannot answer a simple question with evidence: how do we know our most important controls work?

Step 1: agree the mandate

Under the Global Internal Audit Standards (GIAS), internal audit receives its mandate from the board. The mandate specifies the function’s authority, role and responsibilities, and is documented in the internal audit charter.² Standard 6.1 requires the CAE to give the board and senior management the information needed to establish the mandate, and to coordinate with other internal and external assurance providers so that everyone understands each other’s roles. The board’s essential conditions are to discuss the appropriate authority, role and responsibilities and to approve the charter, including the scope and types of internal audit services.²

When you are setting up a function there is usually no CAE yet, so the board has to do this thinking first, often with an adviser or an interim head. The GIAS glossary defines “board” as the highest-level body charged with governance, such as a board of directors, an audit committee or a board of trustees.² In a family-owned company without an audit committee, decide early whether the full board or a newly formed committee will oversee internal audit, and whether an independent non-executive should chair it. The mandate discussion should settle:

• Scope: the whole group, or defined entities, geographies or activities.
• Services: assurance only, or assurance and advisory work, and any special roles such as investigations.
• Authority: unrestricted access to data, records, information, personnel and physical properties.
• Relationships: how internal audit will work with external audit, compliance, health and safety and other assurance providers.

Board and senior management support

Standard 6.3 makes support concrete. The board is expected to champion internal audit, approve the charter, plan, budget and resource plan, ask whether any restrictions on scope, access, authority or resources exist, and meet the CAE periodically without senior management present. The Standards suggest such private meetings at least annually and describe quarterly meetings as leading practice.² If directors are unfamiliar with these duties, short, focused audit committee and internal audit training before the function launches saves time later.

Independence and reporting lines

Standard 7.1 requires a direct reporting relationship between the board and the CAE, board authority over the CAE’s appointment and removal, and an annual confirmation from the CAE of the function’s organisational independence. The Standards describe an administrative reporting line to the chief executive as leading practice, and give as an example of impairment a CAE who reports to the chief financial officer while auditing treasury, which also reports to that officer.² The Chartered IIA Code goes further for UK organisations: the CAE’s primary reporting line should be to the chair of the audit committee, the chair should be responsible for appointing and removing the CAE, and the CAE should be positioned at senior management level.³

Be careful with non-audit roles. If the CAE temporarily takes on responsibilities beyond internal auditing, the Standards require assurance over those areas from an independent third party during the assignment and for the following 12 months.² A common weakness in smaller organisations is asking the finance director or a finance manager to “run” internal audit alongside their day job; that arrangement rarely survives scrutiny.

Step 2: choose a resourcing model

The Standards apply however the function is staffed. The CAE, whether employed directly or provided through an external service provider, is responsible for conformance, and in all cases the board retains responsibility for supporting and overseeing the function.² Standard 8.2 requires the CAE to evaluate whether resources are sufficient and expects the board to discuss sufficiency, in numbers and capabilities, at least annually; the implementation guidance mentions outsourcing and guest auditors as options. Standard 10.2 asks the CAE to consider the cost effectiveness and flexibility of different staffing approaches, such as hiring employees or contracting an external provider, and Standard 10.1 notes that whether the function is insourced or outsourced, the board should still approve an adequate budget.² The Chartered IIA Code adds that an outsourced function is still covered by the Code and that accountability must be retained by the organisation.³

Model	How it works	Often suits	Watch for
In-house team	Employed CAE and auditors	Larger or complex organisations with steady, broad demand	Recruitment lead time, specialist gaps, career paths for a small team
Co-sourced	Employed head of internal audit, with external specialists for IT, data, fraud or peak workload	Organisations that want ownership in-house but cannot justify every skill full time	Clear allocation of responsibility and consistent methodology across both teams
Outsourced	An external provider delivers the plan and may provide the CAE role	Growing or mid-sized organisations establishing internal audit for the first time	Board oversight of the provider, continuity of staff, a named individual acting as CAE
Interim head of internal audit	An experienced practitioner sets up or runs the function for a defined period	Bridging to a permanent appointment or rebuilding after a gap	A documented handover and a plan to transfer knowledge
Guest or rotational auditors	Staff from elsewhere in the business join engagements temporarily	Supplementing any model with business knowledge	Objectivity: the Standards presume impairment if someone audits an activity they were responsible for within the previous 12 months

The last point reflects Standard 2.2.² For many first-time functions, an outsourced, co-sourced or interim internal audit arrangement is a sensible way to start delivering assurance while the board decides on its long-term structure.

Step 3: build the audit universe

The GIAS implementation guidance describes the audit universe as a way of organising potentially auditable units, such as business units, processes, programmes and systems, so that they can be linked to key risks and assessed. Internal audit should independently review and validate the key risks identified by the organisation’s risk management system, and should rely on management’s risk information only if it has concluded that risk management is effective. It should also give due consideration to risks that cut across units, such as ethics, fraud, information technology, third-party relationships and regulatory non-compliance.²

Standard 9.5 requires the CAE to coordinate with other internal and external assurance providers and, where internal audit relies on their work, to document the basis for that reliance.² A practical way to build the first version:

1. Start from the strategy, business plan and risk register, not from the organisation chart alone.
2. List auditable units at a level a single engagement could cover in a sensible timeframe.
3. Interview directors and senior managers about objectives, concerns and recent changes.
4. Map existing assurance: who already gives the board comfort over each area, and how reliable is it?
5. Rate each unit for inherent risk and for confidence in its controls, and record your reasoning.

Step 4: write the charter and methodology

Standard 6.2 sets the minimum content of the internal audit charter: the Purpose of Internal Auditing; a commitment to adhering to the Standards; the mandate, including scope, types of services and the board’s responsibilities and expectations regarding management’s support; and the function’s organisational position and reporting relationships. The CAE must discuss the draft with the board and senior management, and the board approves it.² The Chartered IIA Code states that the charter should be publicly available.³ Our guide to writing an internal audit charter covers the drafting in detail.

Three further documents complete the foundations:

• Internal audit strategy (Standard 9.2): a vision, strategic objectives and supporting initiatives, reviewed periodically with the board and senior management. The guidance suggests the vision might describe the desired state in the next three to five years.²
• Methodologies (Standard 9.3): documented approaches to risk assessment, planning, engagements, communication, monitoring actions, managing external service providers and quality. The CAE must train internal auditors on them. For a small function, a concise manual is enough.²
• Quality assurance and improvement programme (Standard 8.3): internal and external assessments, with internal assessment results reported to the board at least annually. Standard 8.4 requires an external quality assessment at least once every five years by a qualified, independent assessor, with at least one person holding an active Certified Internal Auditor designation.²

Build these to the 2024 Standards from day one rather than adapting old templates. Our overview of the Global Internal Audit Standards summarises what changed.

Step 5: approve the first risk-based plan

Standard 9.4 requires the plan to rest on a documented assessment of the organisation’s strategies, objectives and risks, informed by the board and senior management and performed at least annually. The plan must consider the mandate, specify services that support the evaluation and improvement of governance, risk management and control, consider coverage of IT governance, fraud risk, the effectiveness of compliance and ethics programmes and other high-risk areas, identify the human, financial and technological resources needed, and remain dynamic. The CAE must tell the board about the impact of resource limitations and the rationale for leaving any high-risk area without an assurance engagement, and the board must approve the plan and significant changes to it.²

For a first plan, in practice:

• Put the highest-risk areas first, even if they are uncomfortable. A year of low-risk compliance checks builds activity, not assurance.
• Include an early engagement that will produce visible value, so management sees what good internal audit looks like.
• Hold back capacity for emerging risks and board requests.
• Agree rating scales, report formats and the process for tracking management actions before the first report is issued.

How to set up an internal audit function in 180 days: an illustrative plan

Setting up an internal audit function takes longer in a complex group than in a single-site business, so treat the timings below as an illustration of sequence rather than a target. The order of work is what matters.

Period	Key activities	Board decision or output
Days 1–30	Agree oversight body; discuss mandate, scope and reporting lines; choose an initial resourcing model	Mandate agreed in principle; sponsor and reporting line confirmed
Days 31–60	Appoint or engage the CAE role; draft charter; gather strategy, risk register and assurance information	Charter approved
Days 61–90	Build audit universe; interviews; first documented risk assessment; draft strategy and methodology	First risk-based plan, budget and resource plan approved
Days 91–180	Deliver first engagements; set up action tracking; confirm independence; design the quality programme	First reports to the board; QAIP and external assessment approach agreed

Common mistakes when establishing internal audit

• Starting audits before the board has agreed the mandate and reporting lines.
• Placing the function under the finance director, then asking it to audit finance.
• Copying another organisation’s audit universe instead of building one from your own risks.
• Approving a plan without asking what has been left out and why.
• Outsourcing the work and, in effect, the board’s oversight with it.

How we can help

Innovatex Global helps boards set up internal audit that conforms with the Global Internal Audit Standards from the start. Our internal audit function set-up service covers the mandate, charter, audit universe, methodology and first risk-based plan. We can then deliver the plan through outsourced, co-sourced or interim internal audit, and prepare directors with audit committee and internal audit training. We work with private and family-owned businesses wherever they operate. To talk through your situation, book a free 20-minute call.

Frequently asked questions

Is an internal audit function mandatory for UK companies?

The UK Corporate Governance Code 2024 does not require every company to have one. Instead, its audit committee provisions ask a committee without a function to consider annually whether one is needed, and the annual report should explain the absence and how internal assurance is achieved. Private companies outside the Code make their own judgement, taking account of any sector regulator's expectations.

How long does it take to set up an internal audit function?

It depends on the organisation's size, complexity and starting point. The usual sequence is to agree the mandate and charter, build the audit universe, approve a risk-based plan and then deliver the first engagements, which our illustrative plan spreads over about six months. Recruiting a permanent head of internal audit can take longer, which is why many organisations start with an interim or outsourced arrangement.

Who should the head of internal audit report to?

Functionally, to the board or its audit committee, which should approve the charter and plan and control the appointment and removal of the head of internal audit. The Chartered IIA's Code of Practice says the primary reporting line should be to the audit committee chair. An administrative line to the chief executive is regarded as leading practice, and reporting to a director whose areas internal audit must review creates an independence problem.

References

1. The Institute of Internal Auditors, 16 January 2025. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
2. The Institute of Internal Auditors, 9 January 2024. Global Internal Audit Standards
3. Chartered Institute of Internal Auditors, September 2024 (effective from January 2025). Internal Audit Code of Practice: Principles on effective internal audit in the financial services, private and third sectors
4. Financial Reporting Council, January 2024. UK Corporate Governance Code 2024
5. Financial Reporting Council, 10 December 2018. The Wates Corporate Governance Principles for Large Private Companies