Internal Audit Management

Internal audit is the public sector's third line of defence — the independent function that gives the Accounting Officer and Audit Committee assurance that controls actually work, that public money is spent as appropriated, and that risk is being managed before it crystallises into loss. Under the PFMA and MFMA it is not optional: every department, municipality and public entity must operate an internal-audit unit reporting functionally to the Audit Committee, working to a plan the committee approves.

The discipline lives or dies on the engagement lifecycle. An audit that drifts from Planning to Fieldwork to Report without a controlled scope, dated working papers and a clear team mandate cannot withstand AGSA reliance testing or an IIA external quality assessment. When that lifecycle is managed on spreadsheets and email, scope creeps, evidence goes missing, reports issue late, and the committee loses the line of sight it is legally accountable for — the precise conditions that produce repeat findings year after year.

Done well, internal audit is the early-warning system that keeps an entity out of qualification. Each engagement carries its risk rating, its scope memo and its team, and its findings flow straight into remediation and follow-up. The result is a defensible, tamper-evident record that the function did its job — and the assurance leadership needs to sign the annual report with confidence.