Should internal audit report to the chief financial officer?

When can a line to the finance function work?

An administrative line to the finance function works only where safeguards keep the areas the finance director runs open to challenge. The Global Internal Audit Standards call an administrative line to the chief executive, or equivalent, leading practice, and say a line to another senior officer may achieve the same objective if appropriate safeguards are implemented. The example of the risk they give is a head of internal audit who reports administratively to the chief financial officer while auditing treasury, a function that also reports to that officer.

Where the Code of Practice allows another senior manager, in the private and third sectors, it should be someone “who promotes, supports and protects internal audit’s independent and objective voice”, agreed with the audit committee chair.

Where the line does run to finance, the first safeguard to check is whether anyone in finance has a say in the objectives, appraisal or pay of the head of internal audit. A committee chair should also look for evidence that findings about finance reach the committee as the auditors wrote them.

How much control does the Code give the committee chair?

The Code of Practice puts most of the practical levers in the hands of the audit committee chair. Beyond the primary reporting line, the chair appoints and removes the head of internal audit, sets their objectives, appraises them at least once a year and recommends their pay to the remuneration committee. Where the head of internal audit has served more than seven years, the committee should discuss each year how the chair assesses their independence and objectivity.

The Code also expects the head of internal audit to sit at senior management level, normally executive committee or equivalent, with the right to attend executive committee meetings and access to board and executive committee papers.

What does reporting to the board mean?

Reporting to the board means that the board, which the Standards define broadly enough to include an audit committee, holds the function to account, and a direct line lets the function report its results without interference or undue limitation. The administrative line is often to a member of management, which the Standards say gives access to senior management and the authority to challenge. Whatever the arrangement, Standard 7.1 requires the head of internal audit, whom the Standards call the chief audit executive, to record the reporting relationships in the internal audit charter as the board determines them, and to confirm the organisational independence of the function to the board at least once a year.

Which code applies to which organisation?

Which code applies depends on the organisation. The Global Internal Audit Standards are the international standards for internal audit functions. The Code of Practice is written for organisations in financial services and the private and third sectors with an internal audit function and an audit committee of independent non-executive directors. The UK Corporate Governance Code covers companies with a commercial companies or closed-ended investment funds listing. For those companies, the Financial Reporting Council (FRC) notes in its guidance that the primary line often runs to the audit committee chair and the administrative line to the chief executive.

UK public sector bodies moved to the Global Internal Audit Standards from 1 April 2025, in place of the Public Sector Internal Audit Standards, with an Application Note from the internal audit standard setters for the public sector.

Can the head of internal audit take on other roles?

The head of internal audit can take on other roles, within limits the Standards set as requirements. Ongoing roles beyond internal auditing must be documented in the charter with their safeguards, and where those areas are subject to internal audit, assurance over them must come from elsewhere, such as an objective, competent external provider that reports independently to the board.

Temporary roles carry a stricter rule: an independent third party must provide assurance over those areas during the arrangement and for the following 12 months, and the head of internal audit must plan to hand the responsibilities back to management.

The Code of Practice sets a higher bar. In financial services, and as best practice in the private and third sectors, internal audit should be neither responsible for nor part of risk management, compliance, finance or other control functions. Where a head of internal audit does hold such a function, the Code notes they cannot assess it objectively and that an external assessment of it may be desirable.

Does every company need an internal audit function?

A company that applies the UK Corporate Governance Code need not have an internal audit function, but its audit committee should consider each year whether one is needed and make a recommendation to the board (Provision 25). Provision 26 asks the annual report to explain the absence, how internal assurance is achieved and how this affects the work of external audit. The FRC adds in its guidance that FTSE 350 companies should consider having a function, given their size and complexity. Other boards can follow the same practice: a recorded decision each year, and a clear account of where their assurance comes from instead.

What should an audit committee chair check?

An audit committee chair should check that the charter and the records the committee keeps show:

• both reporting lines recorded in the charter as the board determined them, with the charter approved by the board
• the committee chair setting the objectives of the head of internal audit, carrying out the appraisal and recommending their pay
• the annual confirmation of organisational independence, and any impairment it has ever reported
• meetings with the head of internal audit without management present, at least once a year and every quarter where the board follows what the Standards call leading practice

Where any of these is missing, the charter is the place to start, because the Standards make it the written record of the reporting line.

Each source opens in a new tab.

• The Institute of Internal Auditors, Global Internal Audit Standards, published 9 January 2024: definition of board (Domain III); Standard 6.3 (essential conditions and considerations); Standard 7.1 (requirements, essential conditions and considerations)
• Chartered Institute of Internal Auditors, Internal Audit Code of Practice, September 2024, effective from January 2025: scope (p.4) and Principles 12, 15 to 19, 21, 22 and 24 (pp.8 to 10)
• HM Treasury, letter on the Global Internal Audit Standards in the UK public sector, 31 March 2025 (in force 1 April 2025, with an Application Note)
• The Relevant Internal Audit Standard Setters, in collaboration with the Chartered Institute of Internal Auditors, Application Note: Global Internal Audit Standards in the UK Public Sector, December 2024 (reviewed November 2025), applicable from 1 April 2025
• Financial Reporting Council, UK Corporate Governance Code, January 2024: application (p.5); Provisions 25 and 26 (pp.12 to 13)
• Financial Reporting Council, Corporate Governance Code Guidance, published 29 January 2024, last updated 3 June 2026, paragraphs 196, 200 and 202