The core difference in internal vs external audits is who the work serves. An internal audit is a function inside the company that gives the board and management ongoing assurance and advice on risk, controls and governance. An external audit is an independent CPA firm's examination of the financial statements, ending in a formal opinion that lenders, investors and regulators rely on.
Both look at controls and both report to the board, yet they follow different standards and produce different outputs. This guide compares internal vs external audits on purpose, independence, standards, reporting lines, scope and frequency, explains how SOX 404 ties them together at public companies, and sets out when a private company needs one, the other, or both.
| Factor | Internal audit | External audit |
|---|---|---|
| Who performs it | Company employees, or an outsourced or co-sourced team working under the chief audit executive | An independent CPA firm (a PCAOB-registered firm for public companies) |
| Primary purpose | Assurance and advice on governance, risk management and control | An opinion on whether the financial statements are fairly presented |
| Main users | Board, audit committee, senior management | Shareholders, lenders, regulators, acquirers |
| Standards | IIA Global Internal Audit Standards (effective 9 January 2025) | GAAS from the AICPA for private entities; PCAOB standards for public companies |
| Reports to | Functionally to the board; administratively to senior management, often the CEO | The audit committee (for public companies, by statute) or the owners and board |
| Scope | Set by a risk-based plan; can cover operations, IT, compliance and fraud risk | Set by professional standards, materiality and the auditor's risk assessment |
| Frequency | Continuous, with a plan updated as risks change | Usually once a year, for the fiscal year |
| Output | Engagement reports with findings, ratings and agreed actions | An audit opinion, plus communications on control deficiencies |
| Required by law | Rarely for private companies | For public companies, and for private companies when a lender, investor, grantor or regulator demands it |
Internal audit exists to make the organization work better and to warn the board about risk before it turns into loss. The Institute of Internal Auditors (IIA) states the purpose plainly: internal auditing "strengthens the organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight." That leaves room for advisory work, such as reviewing an ERP rollout, alongside control testing.
External audit has a narrower and more formal goal. The auditor gathers enough evidence to give reasonable assurance that the financial statements are free of material misstatement, whether from error or fraud, and then issues an opinion. The concept of materiality and risk in a financial statement audit shapes how deep the testing goes. An external auditor does not set out to improve your processes, although the management letter often flags weaknesses worth fixing.
An internal auditor is on the payroll or under contract to the company, so independence is organizational. Principle 7 of the IIA Standards is titled "Positioned Independently." The Standards say the internal audit function can only fulfill its purpose "when the chief audit executive reports directly to the board, is qualified, and is positioned at a level within the organization that enables the internal audit function to discharge its services and responsibilities without interference."
Under Standard 7.1, the chief audit executive must confirm the function's organizational independence to the board at least annually. The IIA's implementation guidance adds that a leading practice is for the chief audit executive to report administratively to the CEO or equivalent. This produces the common dual reporting line: functional reporting to the board or audit committee on the audit work itself, and administrative reporting to the CEO or CFO for budget and day-to-day matters.
An external auditor must be independent of the client in fact and in appearance. For public companies, the Sarbanes-Oxley Act wrote key rules into statute. Under 15 U.S.C. 78j-1, the audit committee is "directly responsible for the appointment, compensation, and oversight" of the outside auditor. The same section makes it unlawful for a registered firm to provide a list of non-audit services to its audit clients, and "internal audit outsourcing services" is on that list.
In practice, this means a public company cannot hire its external audit firm to run its internal audit function. Private companies audited under AICPA rules face their own independence restrictions on non-audit services, so check with your auditor before asking them to help with internal control work.
The IIA issued the Global Internal Audit Standards on 9 January 2024, and they became effective on 9 January 2025 as the mandatory core of the IIA's International Professional Practices Framework. They are organized into five domains and 15 principles, with each principle supported by detailed standards:
Domain III matters most to boards, because it covers the internal audit mandate, the charter and the support the board and senior management must give. Standard 8.4 requires an external quality assessment of the internal audit function at least once every five years by a qualified, independent assessor.
Private companies, nonprofits and other nonissuers are audited under generally accepted auditing standards issued by the AICPA's Auditing Standards Board. Our explainer on GAAS standards for 2026 covers the general, fieldwork and reporting principles and the recent SAS updates. Organizations that spend federal money may also face Government Auditing Standards, which our guide to Yellow Book audit standards explains.
Public companies are audited under standards set by the Public Company Accounting Oversight Board. The PCAOB was created under 15 U.S.C. 7211 "to oversee the audit of companies that are subject to the securities laws," and 15 U.S.C. 7213 directs it to set the auditing standards "to be used by registered public accounting firms in the preparation and issuance of audit reports."
Internal audit scope is set by the company's own risk assessment. Standard 9.4 of the IIA Standards requires the chief audit executive to base the internal audit plan "on a documented assessment of the organization's strategies, objectives, and risks," informed by input from the board and senior management. A distribution business might plan reviews of inventory counts, vendor master changes and IT access. Because the plan follows risk, internal audit runs all year and can move resources when something changes, such as an acquisition or a new system.
External audit scope is set by the auditor. It centers on the financial statements and the controls relevant to them, sized by materiality. It happens once a year for the fiscal year, with planning and interim work before year end and most substantive testing after the books close.
An internal audit engagement ends in a report to management and the audit committee. It lists findings, rates each one by risk, records management's agreed action, names an owner and sets a due date. Internal audit then follows up until the action is closed and reports open items to the audit committee.
An external audit ends in the auditor's report with an opinion on the financial statements: unmodified, qualified, adverse, or a disclaimer. The auditor also communicates significant deficiencies and material weaknesses in internal control to those charged with governance. If you are deciding between levels of external assurance, our comparison of a financial statement audit vs review vs compilation shows what each option costs you in effort and what the reader gets.
Section 404 of the Sarbanes-Oxley Act, codified at 15 U.S.C. 7262, has two parts:
Section 404(c) exempts issuers that are neither accelerated nor large accelerated filers from 404(b), and emerging growth companies are also excluded from the auditor attestation. Under SEC Rule 12b-2, an accelerated filer has a public float of "$75 million or more, but less than $700 million," and a large accelerated filer has $700 million or more, both measured on the last business day of the most recent second fiscal quarter. A company that qualifies as a smaller reporting company under the annual revenue test (revenue below $100 million) is excluded from accelerated filer status.
SOX 404 is where the two audits depend on each other. Internal audit, or a SOX team working beside it, usually documents key controls, tests them through the year and gives management the evidence for its 404(a) assessment. The external auditor tests the same controls for 404(b). Under PCAOB AS 2605, the auditor must assess internal audit's competence and objectivity before factoring its work into the audit, so any reliance depends on that assessment. The external auditor still owns the opinion. Separately, Section 302 requires the CEO and CFO to certify each quarterly and annual report, including that they "have evaluated the effectiveness of the issuer's internal controls."
The two companies below are illustrative, and both have filed SEC annual reports for over a year, as the accelerated filer test requires.
| Company A | Company B | |
|---|---|---|
| Shares held by non-affiliates | 18,000,000 | 5,000,000 |
| Share price, last business day of Q2 | $25.00 | $12.00 |
| Public float | $450,000,000 | $60,000,000 |
| Annual revenue | $210,000,000 | $48,000,000 |
| Filer status | Accelerated filer | Non-accelerated filer |
| SOX 404(a) management report | Required | Required |
| SOX 404(b) auditor attestation | Required | Not required |
Company A's float is 18,000,000 x $25 = $450 million, which sits between $75 million and $700 million. Its $210 million revenue is above the $100 million revenue test, so it cannot use that test to avoid accelerated filer status. It needs both management's assessment and the auditor's attestation, and most companies this size run a formal internal audit or SOX testing program to support the assessment.
Company B's float is 5,000,000 x $12 = $60 million, below the $75 million line, so 404(b) does not apply. Management must still assess and report on internal control under 404(a), and the CEO and CFO must still sign the Section 302 certifications. A small internal audit or co-sourced testing program is how many companies at this size produce the evidence behind those signatures.
Private companies are free from SOX 404, so the triggers come from contracts, funding sources and growth.
If this will be your first one, start with our first external audit guide for small businesses and the 30-day PBC request list plan.
Private companies are rarely required by law to have internal audit. The case usually comes from:
A full in-house department rarely makes sense below a few hundred employees. Smaller companies often start with a periodic control review, an outsourced or co-sourced internal audit provider, or a lighter controls program. Our guide to internal controls testing for small businesses covers the testing steps, and the SOX-lite approach for scale-ups shows how to build controls before a first audit.
When both functions exist, coordination saves time and fees. Ask the external auditor at planning which internal audit testing it may use and what documentation that work must meet. Keep process narratives, control matrices and test results in one shared repository so finance staff do not produce the same support twice, and give the audit committee joint updates on open findings.
What is the main difference between internal vs external audits? Internal audit is an ongoing function that serves the board and management with assurance and advice on risk, controls and governance. External audit is an annual, independent examination by a CPA firm that ends in an opinion on the financial statements for outside users.
Can the external auditor also perform internal audit work? For public companies, no. Federal law lists internal audit outsourcing services among the non-audit services a registered firm may not provide to an audit client. Private companies should confirm with their auditor, since AICPA independence rules also restrict certain non-audit services.
Which standards apply to internal audit in 2026? The IIA Global Internal Audit Standards, which became effective on 9 January 2025. They contain five domains and 15 principles and require an external quality assessment at least once every five years.
Does a private company need an internal audit department? There is no general legal requirement. A private company usually adds internal audit, often outsourced or co-sourced, when it grows across locations, prepares for an IPO, or faces repeated control findings.
Do all public companies need an auditor's SOX 404(b) attestation? No. Non-accelerated filers, generally those with a public float below $75 million, and emerging growth companies are exempt from 404(b). All public companies must still include management's 404(a) report.
Madras Accountancy supports US businesses and CPA firms with bookkeeping, month-end close, reconciliations, audit support and CFO advisory, including the schedules and documentation that internal and external auditors ask for. To talk through your audit readiness, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
