Internal audit

Internal audit is an independent and objective assurance and advisory function that supports an entity to improve its governance, risk management processes and internal controls. It provides assurance to the accountable authority and audit committee on whether internal controls are well designed and operating effectively.

The PGPA Act does not require entities to establish an internal audit function. However, internal audit is widely recognised as better practice and can play an important role in strengthening an entity’s system of internal control.

Where established, an internal audit function strengthens the entity’s system of internal control by:

• assessing whether key controls are aligned to the entity’s significant risks
• testing whether controls are operating as intended
• identifying control gaps, weaknesses or duplication
• providing recommendations to improve control design, accountability and assurance without adding unnecessary burden
• supporting continuous improvement as risks and operating environments change
• supporting the entity’s audit committee by providing independent assurance on the effectiveness of governance, risk management and internal control frameworks.

Internal audit does not replace the accountable authority’s responsibility for ensuring the effective design, implementation and operation of an entity’s system of internal control.

Refer to further information under the Commonwealth Risk Management Policy and RMG-211 Implementing the Commonwealth Risk Management Policy (including Element 5: Control effectiveness).

There is no single model for internal audit. It is for the accountable authority to determine whether to establish an internal audit function, and how it operates, having regard to the entity’s size, complexity, risk profile and operating environment.

Internal audit functions may be delivered through:

• an in‑house internal audit team
• a co‑sourced arrangement using internal and external resources, or
• an outsourced provider with appropriate oversight.

Smaller entities may also share internal audit services or participate in portfolio‑based arrangements.

Where an internal audit function is established, it should:

• be independent from the activities it reviews
• have direct access to the accountable authority and audit committee
• be supported by a clearly designated senior official responsible for managing the function
• have access to appropriate skills and experience
• use a risk‑based approach to prioritise audit activity
• focus on governance, risk management and internal controls
• communicates effectively with key stakeholders, including management and the audit committee
• operate in accordance with recognised internal audit standards, adapted to the public sector context.

Internal audit should not focus merely on controls and activities that are easy to assess or measure, such as compliance with travel or credit card policies. Internal audit functions should also undertake activities and evaluations that assist the entity to understand and respond to uncertainty that may affect achievement of its purposes and outcomes.

Internal audit charter

Entities should establish an internal audit charter to formalise the role and position of the internal audit function within the entity’s governance framework.
Better practice charters outline:

• the role and responsibilities of internal audit
• authority and access arrangements
• reporting lines and accountability
• applicable standards and expectations.

The audit committee should review the charter to ensure it supports appropriate authority, independence and reporting arrangements, and that it aligns with the audit committee charter.

The accountable authority should approve the charter and ensure it is available across the entity. The charter should be reviewed regularly to reflect changes in the entity’s operating environment.

Internal audit work plan

Entities may also develop an internal audit work plan to guide audit activity over the planning cycle.

Work plans should:

• focus on areas that support the achievement of the entity’s purposes
• reflect key organisational risks and priorities
• provide sufficient detail to support oversight by the audit committee and accountable authority.

Work plans should be reviewed and updated in response to changes in risks, programs, systems, controls or the operating environment.

An internal audit function is considered better practice to support both the accountable authority and the audit committee.

Internal audit functions commonly support audit committees by:

• providing assurance on the effectiveness of the entity’s system of internal control
• supporting the audit committee’s review of risk management and compliance
• reporting on audit findings, recommendations and management responses
• assisting the committee to monitor implementation of agreed actions.

This relationship supports the accountable authority to meet obligations under the PGPA framework.

Reviewing internal audit arrangements

Accountable authorities should periodically review internal audit arrangements to ensure they remain fit for purpose. Reviews may consider whether:

• audit coverage aligns with key risks and priorities
• resourcing and capability remain appropriate
• reporting lines support independence and transparency
• internal audit continues to add value to governance and assurance processes.

More information on the role of audit committees, including a model charter, is available in RMG-202 Audit committees.

The following resources provide practical examples and frameworks to help you establish and maintain an effective internal audit function:

• Global Internal Audit Standards (2024)
  • These standards should be adapted and/or adjusted to enable their intended application within the entity and government’s operating environment.
• New South Wales Treasury: Internal Audit and Risk Management Policy for the General Government Sector (2020)
• Queensland Audit Office: Internal control assessments fact sheet  and annual internal control assessment tool (2021).

An Internal Audit Community of Practice is available as a network for Commonwealth entities. For enquiries and further information on upcoming meetings, please contact MDB-Audit@ipaustralia.gov.au.