An internal audit unit is an independent assurance function that evaluates risk, tests internal controls and supports institutional governance.

For an audit committee, the real question is not whether to have one, but how to deliver it to the standard the law requires.

The statutory duty comes before the delivery model

When deciding how to structure internal audit, an audit committee should start from the statutory obligation rather than the operating mechanics. Under the internal-control framework set out by the Auditor-General South Africa (AGSA), every institution must maintain an adequately resourced and functioning internal audit unit that periodically identifies, assesses and mitigates risk and tests the effectiveness of internal controls, alongside an audit committee that performs its legislated duties to promote accountability and service delivery. In the public sector the PFMA, as administered by National Treasury, reinforces this by placing fiduciary responsibility on the accounting officer to operate basic financial management systems, including internal controls, across the department and the entities it controls.

In the corporate sphere, the Companies Act 71 of 2008 sets the governance framework for companies, defining the relationships between a company, its shareholders and its directors and providing for the audit committee that oversees financial record-keeping and reporting. Across public entities and companies alike the mandate is non-negotiable, so the question facing an audit committee is not whether to maintain internal audit, but how to structure and deliver it so that Internal audit co-sourcing and outsourcing: a decision guide for audit committees is genuinely adequately resourced and functioning in practice.

The three delivery models

Audit committees generally weigh three delivery models. A fully in-house internal audit unit is staffed by the organisation's own employees; it aligns closely with the organisation's culture, is immediately available, and builds deep institutional knowledge over time, but relying on it alone can strain when complex, highly technical risks demand expertise beyond the permanent team's routine skill set. A co-sourced model keeps an established in-house team but brings in external specialists for specific skill gaps — complex information-technology, forensic or quantitative reviews — so the organisation preserves internal leadership and continuity while drawing on outside expertise.

A fully outsourced model contracts an external provider to deliver the whole function under the audit committee's direct oversight, covering risk assessment, planning, testing and reporting. An audit committee weighs these as structural options for achieving an adequately resourced and functioning capability, not as endorsements of any particular arrangement.

The factors an audit committee should weigh

Choosing a model turns on several governance and operational factors. The first is whether the function genuinely has the technical competence, tools and capacity to address the institution's specific risk profile; where the environment is intricate or the regulatory demands specialised, sustaining an adequately skilled team through direct employment alone may be impractical or cost-prohibitive. Independence and objectivity matter just as much — the function must stay free of operational bias, management interference and self-review so that it can give the audit committee objective assurance.

The committee must also weigh the retention of institutional knowledge, since long familiarity with the organisation's systems and past control breakdowns sharpens audit relevance, and cost-effectiveness, consistent with the PFMA's objective of good financial management through the efficient use of limited resources. Above all, it must recognise that while execution can be co-sourced or outsourced, the statutory accountability and oversight remain firmly with the accounting officer, the board and the audit committee under the PFMA and the Companies Act 71 of 2008, whatever the model.

Above all, it must recognise that while execution can be co-sourced or outsourced, the statutory accountability and oversight remain firmly with the accounting officer, the board and the audit committee under the PFMA and the Companies Act 71 of 2008, whatever the model.
— Synthesis of South African regulatory guidance

How the model connects to assurance and clean audits

Whatever its shape, an effective internal audit function underpins clean audit outcomes. The AGSA's external audit tests three things — whether the financial statements are free from material misstatement, whether performance reporting against predetermined objectives is useful and reliable, and whether key legislation has been complied with — and it identifies the internal-control drivers across leadership, financial and performance management, and governance that make credible reporting possible. Internal audit feeds that foundation directly: it evaluates daily and monthly processing controls, checks reconciliations, tests compliance and assesses risk management, surfacing control deficiencies during the year so that management can act before the external audit.

Resolving weaknesses early prevents recurring findings, reduces unauthorised, irregular, and fruitless and wasteful expenditure, and lowers the risk of the material irregularities that threaten public resources.

Governance safeguards when using external providers

When an audit committee co-sources or outsources, it must put safeguards in place to protect independence and quality. Functional reporting lines should run from the external internal-audit personnel directly to the audit committee rather than to operational management, so that sensitive deficiencies reach oversight without being filtered. Independence safeguards should prevent self-review — an external provider should not audit systems or controls it previously designed or implemented. And the procurement of external internal-audit services must meet statutory procurement standards under the PFMA and the Companies Act 71 of 2008, through a fair, transparent and competitive process. With these safeguards, an external engagement preserves objectivity and upholds statutory governance.

What good looks like

Good is a governance framework where internal audit satisfies the statutory mandate whatever the delivery model. The institution maintains an adequately resourced and functioning internal audit unit that assesses risk, tests controls and gives objective assurance; the audit committee actively discharges its duties under the Companies Act 71 of 2008 and the PFMA, evaluating findings and enforcing accountability; and leadership sustains an ethical culture with proper records, prompt reconciliations and regular monitoring. Internal audit's insights flow into monitored action plans that resolve deficiencies before the external audit — turning clear ownership and objective assurance into credible reporting and sustained clean outcomes.

Related insights

Sources

What we do: internal audit, audit committees and clean audits — Auditor-General South Africa
Public Finance Management Act: legislation overview — National Treasury
Companies Act 71 of 2008 — South African Government

Frequently Asked Questions

What is the fundamental regulatory requirement for internal audit functions in South African organisations?

The Auditor-General South Africa's internal-control framework mandates that every institution must maintain an adequately resourced and functioning internal audit unit. This is reinforced by the PFMA for public sector entities, placing fiduciary responsibility on accounting officers for internal controls, and by the Companies Act 71 of 2008 for corporate entities, which defines the audit committee's oversight role. The core mandate is non-negotiable across both public and corporate spheres.

Who is ultimately accountable for the internal audit function within South African entities?

The statutory accountability and oversight for the internal audit function remain firmly with the accounting officer, the board, and the audit committee. This is mandated under both the PFMA for public entities and the Companies Act 71 of 2008 for corporate entities. The audit committee's role is to ensure the internal audit unit is adequately resourced and functioning, regardless of the delivery model chosen.

What decision-making process are audit committees now facing regarding their internal audit function?

Audit committees are not deciding whether to have an internal audit function, as its mandate is non-negotiable under frameworks like the PFMA and Companies Act 71 of 2008. Instead, they must decide how to structure and deliver it to ensure it is adequately resourced and functioning. This involves weighing three primary delivery models—in-house, co-sourced, or fully outsourced—based on governance and operational factors.

What constitutes effective internal audit compliance, and what are the practical implications of failing to achieve it?

Effective compliance means the institution maintains an adequately resourced and functioning internal audit unit that assesses risk, tests controls, and provides objective assurance, with the audit committee actively discharging its duties under relevant legislation. This leads to internal audit insights flowing into action plans that resolve deficiencies before external audits, fostering credible reporting and sustained clean outcomes. Failure to address weaknesses early can result in recurring audit findings, increased unauthorised, irregular, and fruitless and wasteful expenditure, and a higher risk of material irregularities.

Where do audit committees most commonly encounter challenges when structuring their internal audit function?

Audit committees often face challenges in ensuring the internal audit function genuinely possesses the technical competence and capacity to address the institution's specific risk profile. Another common pitfall is compromising the independence and objectivity of the function, particularly when using external providers, by not establishing direct reporting lines to the audit committee or failing to prevent self-review. Crucially, some may mistakenly believe that outsourcing absolves them of statutory accountability, which remains firmly with the accounting officer, board, and audit committee.

Internal audit co-sourcing and outsourcing: a decision guide for audit committees