ia team reporting

An organisation may have an internal audit function – but no audit committee – or an audit committee but no internal audit (i.e. it may have one but not the other).

Where a company has both – e.g. in compliance with the UK Corporate Governance Code, internal audit must report independently to the Audit Committee, ideally via the Chief Audit Executive (CAE) having a direct, unrestricted line to the chair of the audit committee.

This does NOT mean that internal audit does not report to management/the BoD – it is quite likely that it will report findings to mgt/BoD and make recommendations for improvements. It may also report the most significant of these matters – and mgt/BoD response to recommendations – to the audit committee.