internal audit
If the external auditor is a referee who shows up once a year, the internal auditor is more like a building's own safety inspector who walks the halls every week. Internal audit is a function staffed by the company's own employees (or sometimes outsourced specialists) whose job is to look critically, all year round, at whether the organization's processes, controls, and risk management are actually working — and to report what they find to the company's leadership.
Internal auditors do not just check the financial numbers. They examine operations, compliance with laws and policies, the safeguarding of assets, the efficiency of processes, and whether internal controls are designed well and operating as intended. Crucially, to stay objective, the internal audit team reports functionally to the audit committee of the board rather than to the managers it reviews, even though it sits inside the company. A typical internal audit might pick a warehouse, trace a sample of shipments through the system, and flag that approvals were being skipped — giving management a chance to fix the gap before it causes a loss or before the external auditors find it.
Internal audit matters because problems are far cheaper to catch from the inside and early. It is the organization's own immune system for waste, error, and fraud. The common confusion to clear up: internal audit is not the same as the external audit, and an internal audit report is for management and the board — it is not the public audit opinion that outside investors rely on. The two functions cooperate, but they serve different masters and answer different questions.
A company's internal audit team reviews the purchasing department and discovers that staff can both create new suppliers and approve payments to them — a control weakness. They report it to the audit committee, and management splits the two tasks between different people before any money goes missing.
Internal audit finds control gaps early, from inside, before they cause loss.
Internal audit is not the external audit and does not issue the public opinion investors rely on. To stay objective it should report to the audit committee, not to the managers it reviews.