Audit Quality
Internal Audit Coverage
Extent to which entities have a functioning, adequately resourced internal audit function and risk-based plan.
Why a functioning internal audit function underpins clean outcomes
The MFMA and PFMA require entities to maintain an internal audit function operating to a risk-based plan, and King IV positions internal audit as a core source of assurance. Where internal audit is unresourced, vacant or reduced to compliance ticking, control weaknesses go undetected until the external audit exposes them. AuditPro Core measures internal audit coverage and resourcing so audit committees can confirm that the second and third lines of assurance are actually working.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Functioning IA units
78%
Risk-based plans
64%
Plan completion
71%
No IA function
22
entities
Internal audit maturity by sphere
Internal audit resourcing
| Sphere | IA units | Vacancy % | CAE in place |
|---|---|---|---|
| National | 50 | 9% | Yes |
| Provincial | 79 | 14% | Mostly |
| Local | 198 | 23% | Partial |
| Public entities | 92 | 12% | Yes |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Risk-based, not checklist-based
An effective internal audit function directs its limited capacity to the highest risks through a risk-based plan, rather than auditing low-risk areas by routine. Coverage is meaningful only when it follows the risk profile.
Internal audit in the assurance model
Internal audit is the independent third line that tests whether management's controls actually operate. Without it, the audit committee and accounting officer rely on management's self-assessment alone.
Resourcing determines reach
A plan is only as good as the capacity to execute it. Vacancies, budget cuts or over-reliance on co-sourcing can leave large parts of the risk universe unaudited despite a documented plan.
How AuditPro Core Bridges the Gap
- Coverage measurement: AuditPro Core tracks how much of each entity's risk universe the internal audit plan actually covers.
- Resourcing visibility: staffing, vacancies and plan execution rates are monitored against the approved plan.
- Gap traceability: uncovered high-risk areas are surfaced for audit committee attention.
- Assurance export: the coverage analysis exports for audit committee and combined-assurance reporting.
Key Takeaways
- Internal audit is a statutory requirement and a core assurance line.
- Coverage is meaningful only when it follows a risk-based plan.
- Internal audit independently tests whether controls actually operate.
- Resourcing gaps leave high-risk areas unaudited despite a plan.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.