If permitted (e.g. it is not permitted for listed audit clients if the internal audit services related to “a significant part of the internal controls over financial reporting”), the usual safeguards would be completely separate teams (for “audit” engagement and “internal audit” services) and an “appropriate reviewer” reviewing the audit work or service performed.