Risk, Governance and Internal Audit
An audit committee needs internal audit it can believe and act on. A chief executive, chief financial officer or finance director needs to know that risk is owned, and that governance holds up when the board looks closely.
Where the head of audit post is empty, new or part time, James can take it on as a fractional or interim head of internal audit, or chief auditor, reporting to the audit committee. He can also advise a sitting head of audit or the audit committee chair, and help executives build risk and governance arrangements that work in practice.
He is a Chartered Internal Auditor and a Fellow of the Association of Chartered Certified Accountants. He has been Global Head of Audit for Equities at Credit Suisse, and in several countries he has taken audit work to audit committees and answered their questions. A committee that brings him in gets someone who has led the kind of function it oversees, and who knows what a committee needs to hear from its head of audit.
Purpose
What internal audit is for
“Internal Audit, done well, is a compelling voice that inspires confidence in the ability of an organisation to deliver its strategy.”
James Walker, Founder, Lightning Oak
Internal audit builds that confidence by testing how an organisation manages its risks and governs itself, among other things. James also takes on risk and governance work in its own right, from a review of how things work today to building the risk framework or leading it part time.
From his seats on audit and risk committees across sectors, James knows how a report on audit, risk or governance reads to the people who receive it. He also knows what helps a committee or a board decide what to do next, and see it through.
When it helps
Moments that stretch a function
These moments come to regulated and unregulated organisations alike, and to audit functions large and small. Each one reaches a different person first, and spotting it early gives that person time to choose the right help and set it up properly.
01
Vacancy at the top
The head of internal audit has left, or the organisation has never had one. The audit committee chair and chief executive need a senior person to lead the function, as an interim until a permanent head is found, or part time where a full-time post is not needed.
02
New in the role
A newly appointed head of internal audit has inherited a function, a plan and a committee with its own expectations. Someone who has already done the job can help them set priorities and shape the committee relationship while it is still forming.
03
External assessment falling due
An external quality assessment is on the audit committee forward plan, and the function has yet to face one under the Global Internal Audit Standards. The head of audit and the committee want a clear read of where it stands, and of what to put right first.
04
Outgrowing the risk framework
The risk framework still describes the business it was written for, or the business has grown without one. The chief executive, finance director or founder needs a clear owner for each risk, and reporting that shows the board where the business is most exposed.
05
An exit or listing ahead
A buyer or the market will ask what assurance the board has had, and a fractional head of internal audit can give the board its own evidence well before the data room opens.
The work
Where James fits in your function
A head of internal audit may want a senior advisor, help with the audit strategy or a specialist area, or a readiness review before an external assessment. An audit committee chair may want advice as well, or James to lead the function while the post is empty or new. Where the head of internal audit is a senior management function, as in a bank or a larger insurer, the regulator must approve James for it before he takes it on.
Senior internal audit advisor
As advisor to a head of audit or an audit committee chair, James gives an experienced view on a sensitive report before it reaches committee, or on the committee relationship. He can help frame a difficult finding so it lands, starting from the issue and setting out its impact and likelihood together, with the executive who owns the area seeing it before the committee does.
Strategy and specialist cover
He helps shape the audit strategy, so the plan follows the risks the business is taking and keeps room to respond as they move. He can also cover a specialist area such as lending or trading businesses. For risk and control culture, he designed the audit approach that a global bank then used worldwide.
Interim or fractional leadership
He can lead internal audit as your head of internal audit or chief auditor, part time or as an interim, including building a new function. The role can sit alongside a co-source provider, work with an in-house team or, in a smaller organisation, stand on its own, with James carrying out the reviews himself and bringing in specialists, under their own engagement, where the plan needs them.
Ready before the assessment
He prepares a function for an external quality assessment against the Global Internal Audit Standards, and tells you and your committee what the assessor is likely to find before they arrive. His review covers conformance and whether each report says what its rating claims.
Experience
Commissioning internal audit and leading it
A charity committee that had never commissioned internal audit and a dual-regulated bank asked very different things of James. He sat on the first as an independent member and led the audit work in the second.
Commissioning audit for the first time
As an independent member of the audit and risk committee at a national grant-making charity, he persuaded the committee to commission internal audit for the first time. He then ran the selection of the provider that would deliver it.
Prudential assurance at a bank
At a dual-regulated bank he led the prudential assurance programme for the UK legal entities, across liquidity, capital, funding and interest rate risk. He also gave assurance over the remediation that followed a letter from the regulator.
Planning
An audit plan that adapts as the risk moves
The Global Internal Audit Standards require the audit plan to be dynamic, updated as the business, its risks and its controls change. James makes that practical from the start, leaving part of the plan deliberately unallocated so the function can turn to a new risk while it still matters.
He led the audit plan on this basis while a global investment bank was being wound down, as new risks emerged week by week. The spare capacity was used, and it let the team work alongside the business as events moved. Each significant change to the plan still needs approval, as the Standards require, so the audit committee keeps sight of what the function is doing and why.
Independence
A note to audit committee chairs
Which role James takes decides where his reporting line runs. In both, your committee sees the arrangement from the start.
When James leads your function
When James leads internal audit for you, he reports to your committee on the work of the function, and the chief executive holds the day-to-day line, as the Internal Audit Code of Practice expects. You agree the scope, and what sits outside it, before the work begins. Your committee approves his appointment and his terms, can end them, and meets him without management present at least once a year. Within a group, he also reports to the group chief auditor, and you see how the two lines fit together.
When James is an advisor
If your head of internal audit brings James in as an advisor, or you do, the reporting line stays exactly where it is, and you see the arrangement from the start. In either role, any earlier work he has done for your executive team, and any other conflict of interest, is set out for you and settled in writing when the work is scoped, before it can affect what reaches your committee.
“He is trusted for his clear judgement and integrity and for the thoughtful way he develops global teams - giving people space to deliver, backing them when it matters, and helping them grow.”
Risk and governance
Working directly with executives and boards
Chief executives, finance and operations directors, founders and boards can bring James in for risk and governance work of its own, apart from any audit of it. He works for one side at a time at any one organisation, the executive or the audit function and its committee, and what he learns on one side stays within that engagement. At least a year passes before he audits anything he has built or run, in line with the Global Internal Audit Standards.
A review of how it works
James can review how risk and governance work day to day across the business, and how they reach the board. The review looks at who owns each risk, who may decide what and how the committees share the work, so the board and the executive know what to keep and what to change. Where the company follows the UK Corporate Governance Code, the review can take in the controls the board will treat as material and the evidence behind each.
A framework that fits the business
For a business that has outgrown its first risk framework, or never had one, James can build the framework it needs, as he has helped young organisations do. It sets out the risks that matter and the risk the board will accept, sized for the business now, with foundations for the one it plans to become.
A senior risk lead, part time
An organisation that needs a senior person to build and own its risk framework, before a full-time risk lead makes sense, can bring James in as a fractional chief risk officer. In some firms, such as banks and larger insurers, the chief risk role is a senior management function, so the regulator must approve James for it first, and he starts once it has.
Governance advice for the board
Founders, chairs and chief executives can bring James in to advise on governance as the business grows or its ownership changes. He helps set up the board and its committees, the terms of reference each works to, and the matters the board keeps for itself, with clear authority delegated below it. He has done this for founder-led businesses and new boards.
Questions
Internal audit and risk
Whether James leads a function or advises the person who leads it, the same questions tend to come first: who stays accountable for what, where the reporting lines run and how the arrangement fits the Global Internal Audit Standards.
Does a smaller organisation need a full-time head of internal audit?
A smaller organisation does not always need a full-time head of internal audit. A fractional head of internal audit leads the function on fewer days a week. When the post is being filled or created, that gives an organisation an experienced head of audit for the time the work needs, in place of a less senior full-time hire. James can take on the role on that basis. The committee decides how senior its head of audit needs to be, the days follow from the plan, and cover for committee meetings and year end is agreed with the committee chair before he starts. The function keeps its reporting line to the audit committee.
Can a head of internal audit have a senior advisor of their own?
A head of internal audit can have a senior advisor of their own. A senior advisor outside the reporting line gives a head of internal audit someone to test their thinking with. An advisor helps most before a difficult committee meeting, while an adverse finding is being written or when the plan and the resources will not reconcile. James has led audit teams whose work went to audit committees, and knows what a committee listens for. The advisor works with the person, and the function, its plan and its reporting line to the audit committee stay as they are.
Who should the head of internal audit report to?
The head of internal audit should report functionally to the board, which in practice means the audit committee and its chair, and administratively to a senior executive. The Global Internal Audit Standards, in effect since 9 January 2025, describe an administrative reporting line to the chief executive as leading practice. In the UK, the Internal Audit Code of Practice expects that line in financial services, and as best practice in the private and third sectors, where the audit committee chair can agree another senior manager in certain cases. A line to the finance director then needs safeguards the chair can check, because internal audit reviews the areas that officer runs.
What does an external quality assessment involve, and how often is one needed?
An external quality assessment is an independent review of an internal audit function against the Global Internal Audit Standards, needed at least once every five years. Standard 8.4 requires a qualified, independent assessor or team, either for a full external assessment or to validate a self-assessment, and the board receives the results. An earlier assessment is worth considering after a new head of audit, a change of method or a merger of functions. The assessor the committee approves stays independent of anyone who helped prepare the function, James included.
What does Provision 29 mean for internal audit?
Provision 29 asks boards to declare whether their material controls were effective, and internal audit can supply much of the evidence behind that declaration. The provision, in the UK Corporate Governance Code 2024, applies to financial years beginning on or after 1 January 2026. Boards of companies that apply the Code make the declaration on a comply or explain basis, as at the balance sheet date, and external assurance is not required. The evidence from internal audit holds its value as long as the function is not also designing and running the controls it assures.
What is the difference between co-sourced and outsourced internal audit?
Co-sourcing adds outside help to an in-house function, while outsourcing hands the whole function to a provider. In a co-sourced arrangement the head of internal audit keeps the plan and the reporting line to the audit committee. Outside help brings capacity or expertise for particular reviews, specialist areas or a senior second opinion. James can join a co-sourced arrangement as the senior layer, taking the reviews that need the most judgement.
What does a fractional chief risk officer do?
A fractional chief risk officer builds and owns the risk framework of an organisation part time, before a full-time risk lead makes sense. In a bank or larger insurer, the regulator approves him for the role first.
Insights
Writing on audit, risk and governance
James writes on internal audit, risk and governance, in articles for professional bodies and in plain briefings on this site. The pieces below follow on from the questions above, for readers who want the reasoning behind the short answers.
Fractional chief auditors
What an audit committee chair should expect of a fractional head of audit, so that the committee keeps the independence and the direct line it would have with a full-time appointment.
How should internal audit prepare for an external quality assessment?
What a head of internal audit should settle with the committee, and have ready, before an external quality assessment begins, so that nothing in the evidence comes as a surprise.
Should internal audit report to the chief financial officer?
Where the head of audit should report day to day, and the safeguards an audit committee chair should check where that line runs to finance.
Where does a board’s assurance for Provision 29 come from?
Where the evidence behind a board declaration on material controls comes from, and what the executive team needs to have in place well before the board is asked to sign it off.
Bring James in to lead, advise or review
An audit committee chair can begin with a review of where the function stands, or with James leading it part time or as an interim. A head of internal audit can begin with a senior view on one report or one committee meeting, or a readiness review before an external quality assessment, ending with a short written note of where the function stands against the Standards and what to put right first. A chief executive, finance director or founder can begin with a review of how risk and governance work today, ending with a short written view of who owns each risk, what the board sees and what to change first, and decide from there what should follow.