Recent UK governance changes are likely to lead to smaller quoted companies looking more closely at the way they manage risk and how they ensure that business practices are effectively supporting their organisation.

More companies are likely to look at having some sort of internal audit function, although resource is likely to be limited. With that in mind what should the smaller business be looking for in its internal audit function? Here are my thoughts:


Internal audit isn’t just about checking transactions and controls, it also a consultancy activity. It requires an appreciation of the strategic dimension and how business is done. Recommendations to strengthen practices in one area could have a knock on effect elsewhere and a balanced view is required. Some of the biggest risks organisations face are non financial (such as reputational damage) or are not directly related to systems and processes. The auditor needs to be mindful of the big picture, as well as cost constraints.

Attention to detail

While the ability to see the big picture is important, the auditor will need to be able to understand the detailed aspects of processes and also to have an eye for the unusual.


The people dimension. The auditor should understand the challenges and pressures staff face and to be able to put people’s mind at ease. Being able to think about practicalities, such as whether reports are easy to use, is also helpful.

There should also be empathy with the constraints of smaller businesses, pragmatism may be required. It is also helpful to be mindful of the ways that people can be encouraged or helped to improve.


While lessons can be learned from the past it is important for the auditor to focus on the future and avoid being unnecessarily critical. Points scoring should be avoided.

Independence of mind

The auditor should be able to stand back and not be unduly influenced by the agendas of others. While the empathetic approach may sometimes result in the auditor giving ground in the face of disagreement, when push comes to shove the auditor must be prepared to be firm in his/her opinions and also to be critical where necessary.

Acknowledge their own limitations

While a broad skills set is required, there may occasionally be areas that are outside the auditor’s skills set – the auditor should be prepared to request specialist support.

Some familiarity with the organisation

This makes it easier for the auditor to connect with what’s happening in the business and to operate effectively. However overfamiliarity can also be problematic!


The ability to quickly adapt to new scenarios and to relate to people at all levels in the organisation.

Report writing skills

The reports should be clearly laid out to make it easy for recipients to follow, with easy to see recommendations and a summary of key points.

Last but not least – board backing

Internal audit should not be there just to tick a governance box, it should make a genuine contribution to helping the business move forward. It will only be truly effective if it is received in that spirit across the organisation and to make that happen it not only needs to be delivered by the right people, it should also be given strong board backing.

Further reading about internal audit in smaller businesses

You might also like to read 8 differences between internal and external audit.

Resourcing internal audit can be an issue for smaller businesses – my LinkedIn post Really? Outsourced ‘internal’ audit? prompted some interesting comments on the subject.

This article was posted in January 2015