Management and Internal Audit: Evolving Together
Why the maturity of internal audit is connected to the maturity of management — and how internal audit can contribute to better management practices.
1. Is Internal Audit a Privilege of Large Companies?
When people think about internal auditing, they often imagine a large bank, an international corporation, or a company with a complex organizational structure. Such organizations may have dedicated internal audit departments, formal risk management systems, structured internal controls, and sophisticated management reporting.
But does a business employing 30, 50, or 100 people need internal audit? Is it worth the cost if the owner manages the business directly, the accountant maintains the books, and department managers oversee day-to-day operations?
At first glance, the answer may seem obvious: a small business has limited resources, so establishing a separate internal audit department may not be economically justified.
However, as a business grows, the nature of management changes. Transaction volumes increase, the number of business partners expands, new processes emerge, and management needs more information to make decisions. The owner can no longer personally check everything, and managers may not have sufficient time or information to identify problems promptly.
This raises an important question: how can a business know whether its risks are being managed appropriately, its controls are working, and management decisions are based on reliable information?
This is where internal audit may become valuable.
The question, however, is not simply whether every business needs a separate internal audit department. More importantly, we need to understand what level of internal audit development is appropriate, what determines its effectiveness, and how it can contribute to the development of management itself.
2. Internal Control and Internal Audit: Different Functions, a Common Purpose
To answer this question, we must distinguish between internal control and internal audit.
Internal control comprises the processes, policies, and procedures designed to help an organization achieve its objectives, manage risks, prevent errors, and ensure that operations are performed appropriately.
Examples include payment approvals, segregation of duties, purchasing controls, receivables monitoring, inventory counts, and production cost controls.
Internal audit is an independent and objective assurance and advisory activity designed to evaluate and help improve an organization's governance, risk management, and control processes.
Internal auditors should not replace managers or assume responsibility for management decisions and operational controls. Their role is to assess whether processes are appropriately designed, whether controls address relevant risks, and whether those controls operate effectively.
Therefore, even a business without a dedicated internal audit department needs appropriate internal controls. The question is whether it also needs an independent internal audit function, what form that function should take, and how it should be organized.
There is, however, a deeper issue: internal audit does not operate in isolation. Its capabilities depend partly on how the business is managed.
3. Global Internal Audit Standards and Business Reality: Where Is the Challenge?
The Global Internal Audit Standards, issued by The Institute of Internal Auditors (IIA) and effective from January 2025, establish professional requirements for the organization and performance of internal auditing. They address the purpose and ethics of the profession, governance of the internal audit function, management of the function, performance of audit engagements, and evaluation of effectiveness.
The Standards place internal audit within the broader context of organizational governance, risk management, and internal control. They address relationships with the board and senior management, appropriate authority and independence, and access to the information needed to perform audit engagements.
This is a natural foundation for a professional internal audit function that evaluates how an organization is governed and managed.
In practice, however, organizations are at different stages of development.
Large companies may have boards or supervisory boards, audit committees, formal risk management processes, structured internal control systems, and well-developed management reporting.
A small or medium-sized business may not have all these mechanisms. Some may be informal, some may be performed directly by the owner, and others may still be developing.
For example, risk management may not exist as a formal process. The owner may assess risks based on experience, while decisions are made quickly without documented procedures. Employees may perform overlapping duties, and controls may rely mainly on established habits rather than formal policies.
This raises a practical question: how should internal audit be organized when some of the management mechanisms with which it needs to interact have not yet been fully developed?
It would be incorrect to conclude that the Global Internal Audit Standards are unsuitable for smaller businesses. It would be equally incorrect to assume that every business must mechanically reproduce the management structure of a large corporation.
The Standards establish professional requirements for the internal audit function. The practical challenge is to apply them appropriately in the context of the organization, considering its structure, objectives, risks, and operating environment, while respecting the applicable professional requirements.
But there is an even more important question:
Should internal audit simply adapt to the existing management system, or can it also contribute to the development of that system?
4. Management and Internal Audit: A Two-Way Relationship
In my view, the maturity of internal audit is directly connected to the maturity of management. However, this relationship is not one-directional.
On the one hand, management maturity determines the environment in which internal audit operates.
When organizational objectives are defined, responsibilities are allocated, key processes are established, risks are assessed, and management uses reliable information to make decisions, internal audit can systematically evaluate these mechanisms. It can assess their effectiveness, determine whether controls address relevant risks, and recommend improvements.
When management depends heavily on the owner's personal involvement, decisions are made reactively, and procedures are not formalized, internal audit faces different challenges. It may need to begin by assessing basic processes, identifying key risks, examining the allocation of responsibilities, and identifying critical control weaknesses.
Thus, management maturity influences the capabilities, priorities, and organizational form of internal audit.
But there is also a reverse relationship.
Internal audit can identify problems that extend beyond individual errors or violations. For example, recurring purchasing irregularities may indicate unclear responsibilities. Persistently increasing receivables may reveal weaknesses in credit policy and customer monitoring. Significant production cost variances may point to inadequate management information or ineffective production controls.
In these situations, recommendations may need to address not only individual deficiencies but also the underlying management mechanisms: allocation of responsibilities, reporting, risk management procedures, control systems, and monitoring.
Internal audit therefore does not simply occupy a place within an already established management system. It can help identify weaknesses and create conditions for further development.
At the same time, internal audit must not assume management's responsibilities. Management remains responsible for setting objectives, managing risks, establishing controls, and deciding how to respond to recommendations. Internal audit provides independent and objective assessment and helps identify opportunities for improvement.
Management development creates conditions for more mature internal audit, while effective internal audit can become one of the drivers of further management development.
This two-way relationship should be considered when determining the appropriate role and organizational form of internal audit.
5. How Does This Relationship Work in Practice?
Consider three illustrative situations.
Case 1. A Small Trading Business
The owner directly oversees purchasing, sales, and payments. The accountant maintains the books, while management decisions are based on financial results and the owner's experience.
Over time, the business experiences declining profitability, increasing receivables, and accumulating slow-moving inventory.
At an early stage, internal audit efforts could focus on purchasing, inventory, sales, and customer balances. The results may reveal not only individual errors but also the need for regular inventory analysis, formal credit limits, or improved management reporting.
In this example, management needs determine the initial audit priorities, while audit findings help improve management processes.
Case 2. A Growing Manufacturing Business
The company expands production, increases its workforce, and purchases more materials. The controls previously exercised directly by management no longer provide sufficient visibility over operations.
The business needs clearer responsibilities, defined cost standards, variance monitoring, and regular analysis of production performance.
Internal audit can assess production risks, evaluate inventory and cost controls, and identify weaknesses in management information.
Based on the findings, management may improve production cost monitoring, assign responsibility for variance analysis, and introduce regular management reporting.
As these mechanisms develop, internal audit can also evolve: from reviewing individual problem areas to systematically assessing risk management and internal controls.
Case 3. A Group of Companies
Several companies operate within a group, each with different processes, managers, and control practices. Owners and central management need comparable information about risks, operational performance, and the quality of internal controls.
In this situation, internal audit development may involve common approaches to risk assessment, audit planning, documentation, and follow-up.
At the same time, audit work may reveal the need to standardize management reporting, clarify managerial responsibilities, and improve controls across the group.
Internal audit, therefore, not only evaluates the existing management system but can also help identify opportunities for its further development.
These examples illustrate a general principle: the form and priorities of internal audit should reflect the state of management, while audit results can influence how management develops.
6. Does Every Business Need a Separate Internal Audit Department?
No. The need for independent assessment does not automatically mean that a company must establish a separate in-house department.
The appropriate form of internal audit depends on the scale and complexity of operations, management structure, risk profile, available resources, and applicable legal and regulatory requirements.
For some organizations, an in-house internal audit function may be appropriate. Others may engage external specialists to perform defined internal audit assignments without maintaining a permanent audit team. In certain circumstances, a phased approach may be suitable, with the function developing as the business and its management processes mature.
However, internal audit must be distinguished from routine management control. Managers, accountants, and finance directors may perform important control activities, but their existence does not by itself mean that the organization has an independent internal audit function.
Similarly, an external financial statement audit is not automatically a substitute for internal audit: the two activities have different objectives and scopes.
Where an organization is subject to legal or regulatory requirements concerning internal audit, its arrangements must comply with those requirements.
For other businesses, the key question is not simply whether a department exists, but whether independent assessment of risks, controls, and management processes is needed and how it can be provided effectively.
7. Where Should a Business Begin?
If a business does not yet have a mature management system, a gradual approach may be appropriate.
Step 1. Understand the business objectives and risks.
Identify what matters most to the business, what events could prevent it from achieving its objectives, and where potential losses could be greatest.
Step 2. Assess existing controls.
Determine who is responsible for key processes, how transactions are approved, who checks the results, and whether there is evidence that controls are actually performed.
Step 3. Identify priorities for independent assessment.
There is no need to review every process at once. Focus initially on significant risks and areas where management lacks reliable, objective information.
Step 4. Develop practical recommendations.
Recommendations should reflect the organization's actual capabilities. Initial priorities may include clarifying responsibilities, introducing regular reporting, or improving payment controls rather than implementing a complex risk management framework immediately.
Step 5. Evaluate results and revise priorities.
After changes are implemented, assess whether risks have decreased, management information has improved, and the new procedures are working. As the business develops, internal audit priorities should also evolve.
This approach treats internal audit development as a continuing process linked to management development rather than as a one-time exercise in establishing an organizational structure.
8. Internal Audit as a Driver of Management Development
Internal audit should not become an additional bureaucratic procedure, duplicate accounting controls, or be limited to finding errors.
Its potential value lies in helping management better understand risks, evaluate the effectiveness of controls, identify systemic problems, and make informed decisions about improving operations.
For a small business, this may mean identifying inventory losses or receivables problems early. For a medium-sized company, it may involve improving purchasing, cost, and departmental controls. For a group of companies, it may mean developing consistent approaches to risk assessment and internal control.
However, the effectiveness of internal audit depends partly on management's willingness to consider its findings, evaluate recommendations, and take responsibility for decisions.
Internal audit development cannot therefore be reduced to training auditors, approving a charter, or introducing audit methodologies. It is also connected to management culture, risk awareness, managerial accountability, and the willingness to improve processes.
This is where the two-way relationship becomes clear: more mature management creates better conditions for internal audit, while effective internal audit can help management become more mature.
Conclusion
There is no universal answer to whether a small or medium-sized business needs internal audit based solely on its workforce or revenue.
The decision should consider business objectives, risk exposure, process complexity, the state of internal controls, and management maturity.
The Global Internal Audit Standards provide professional requirements and guidance for developing the internal audit function. The practical challenge is to apply them appropriately within each organization's context while supporting the continued improvement of management processes.
Management and internal audit evolve together. Management creates the environment in which internal audit operates, while internal audit helps identify opportunities to improve management. Its development should therefore be viewed not merely as the establishment of a new function, but as part of the evolution of the organization's management system.
This relationship is one of the central themes of my practical book, Internal Auditing: Foundations, Methodology and Future Development, which addresses professional standards, internal audit organization, and practical approaches to risk and control assessment.
Further reading and book information
My article introducing the Ukrainian and English editions is available here:
English PDF edition:
https://secure.wayforpay.com/payment/internal-auditing-eng
Amazon Kindle and paperback edition:
https://www.amazon.com/dp/B0HD8FTS2D
Join the Discussion
Do you agree that internal audit maturity is connected to management maturity? Which management capabilities are most important for developing internal audit in small and medium-sized businesses?
I welcome your professional views, practical examples, and constructive criticism.
Serhiy Lozovytskyy
Auditor | Educator | Author
