When does a private equity-backed company need internal audit?

Does a private equity-backed company have to have internal audit?

Neither of the main UK governance codes requires one, so unless a regulatory rule or an agreement binding the company applies, the decision rests with the board. The UK Corporate Governance Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, and the Financial Reporting Council (FRC) states that it does not apply to private companies. Large private companies in scope of the Companies (Miscellaneous Reporting) Regulations 2018 must disclose their governance arrangements instead, and research published by the FRC in 2022 found the Wates Principles the most widely adopted framework for doing so.

The Wates Principles ask boards to establish “formal and robust internal processes” so that systems and controls operate effectively, and say “the size and nature of the business will determine the internal control systems” put in place. For the listed-company practice of deciding each year whether a function is needed, see the briefing on whether internal audit should report to the chief financial officer.

What should prompt a board to set up internal audit?

The FRC guidance points to rising risk as the test. Where there is no function, the guidance suggests the audit committee keep the question under review, looking at whether risk is rising from outside or from change inside the company, such as restructuring or new systems, and at what its monitoring of controls is showing.

Applied to a private equity-backed company, those prompts tend to follow the investment. Each acquisition in a buy-and-build plan adds systems to control, a carve-out needs a finance function of its own, and a new finance system after the deal changes how the numbers are produced. Any of these is a reason to ask again before the next regular review.

Does the answer change ahead of a listing?

It does, because the Code applies from the date of listing, and the FRC says that before listing, companies “should consider the Code requirements and, where possible, prepare in advance”. Once listed, a company also gives a board declaration on its material controls; the briefing on where a board’s assurance for Provision 29 comes from covers it. A function set up well before listing would have a record of work behind it by the time the Code applies.

What if the company is regulated by the FCA?

A rule in the FCA Handbook may then require a function. The rule is 6.2.1R in the Senior Management Arrangements, Systems and Controls sourcebook (SYSC), and it covers common platform firms, UCITS management companies and operators of peer-to-peer lending platforms. Where appropriate and proportionate to the nature, scale and complexity of the business, they must establish and maintain an internal audit function “separate and independent from the other functions and activities of the firm”, and other firms within the SYSC rules should take account of that rule as if it were guidance.

In firms authorised by the Prudential Regulation Authority, and in enhanced scope firms under the Senior Managers and Certification Regime, the role of head of internal audit is a senior management function (SMF5). The briefing on what a buyer should check in an FCA-authorised firm’s governance covers the diligence side.

Does internal audit need an in-house team?

Not necessarily. The Global Internal Audit Standards apply equally to internal auditors on the payroll, to those supplied by an outside firm and to a mix of the two. The Standards call the head of the function the chief audit executive (CAE), and whatever the model, the board stays accountable for backing and overseeing the function, including approving its budget and charter. The audit committee guide from EY, the professional services firm, compares in-house, outsourced and co-sourced models, each with trade-offs, and the choice is subject to any regulatory requirements on outsourcing.

A fractional head is a further route. In his own article on fractional chief auditors, published by the Chartered Institute of Internal Auditors, James sets out his view that the role needs formal recognition in the internal audit charter, with the same functional independence as a full-time head, and that “A fractional CAE is still the CAE”. The article lists “rebooting or building a function” among the places the model fits.

What should a private equity board ask about internal audit?

It should ask whether a decision on internal audit has been recorded and, where there is no function, what gives it assurance instead. The FRC wrote its conversation starters for investors to put to audit committee chairs, and the questions carry over to a private equity board, where, as the EY guide notes, investor representatives often sit on the committee. Questions worth asking, drawing on those starters, the EY guide and the Standards, include:

• where there is no function, which other sources give the committee assurance over risk management and internal control
• when the board last considered the need, and which changes since the deal it took into account
• how the committee makes sure the internal audit plan follows the main risks of the business
• whether the function has the resources for its mandate and plan, which the Standards ask the board to discuss with the head of internal audit at least once a year

A board that cannot answer one of these from its minutes could ask for a paper at its next meeting.

Each source opens in a new tab.

• Financial Reporting Council, UK Corporate Governance Code, January 2024: application (p.5); Provision 25 (pp.12 to 13)
• Financial Reporting Council, UK Corporate Governance Code 2024, web page: who the Code applies to, and when it applies to a company (undated page)
• Financial Reporting Council, Corporate Governance Code Guidance, published 29 January 2024, last updated 3 June 2026: paragraphs 196 and 197
• Financial Reporting Council and the Wates Coalition Group, The Wates Corporate Governance Principles for Large Private Companies, 10 December 2018: guidance to Principle Three (integrity of information) and Principle Four (risk); with the FRC web page on who the Principles apply to and how reporting against them is assessed, including the February 2022 research
• Financial Reporting Council, Audit Committees and Assurance: Conversation Starters, web page launched 19 April 2023: internal controls and internal audit
• Financial Conduct Authority, FCA Handbook, Senior Management Arrangements, Systems and Controls sourcebook (SYSC), 6.2 Internal audit: SYSC 6.2.1R, 6.2.1AG and 6.2.2G, as last modified 23 October 2025
• The Institute of Internal Auditors, Global Internal Audit Standards, published 9 January 2024: Fundamentals (applicability of the Standards); Domain III (application of the domain); Standards 6.1, 8.2 and 10.1
• EY, Audit Committee Guide: International considerations for audit committees, with localizations relevant to the UK, 2025: section 2.2 (public versus private companies) and section 6.6 (internal audit)
• James Walker, Fractional chief auditors, Chartered Institute of Internal Auditors, Content Hub, 5 May 2026