What are the differences between internal and external auditing?

Before becoming an academic, I actually was a director and service line leader for the Big Four professional service firm Deloitte. Deloitte, PWC, E&Y and KPMG perform external audits. They are hired by an organisation to express an opinion whether their financial statements are free of misstatements. If you look at the financial reports of a company, you find this statement at the back. This assures current shareholders, future investors and business partners that the figures reported are true and that they comply with certain accounting standards, such as International Public Sector Accounting Standards or Generally Accepted Accounting Principles in the US. External auditors are members of a recognised professional accountancy body.

In the UK, they are chartered accountants, and in the US, certified public accountants. Internal auditing is different from external auditing. Before my time at Deloitte, I worked for the then-largest European media company. While I was there, a team of internal auditors from our headquarters visited our subsidiary. Unlike the Deloitte employees, these were colleagues, that is, employees of our company. Their main task was to ensure that our subsidiary followed the guidelines specified by the headquarters. For example, they check whether a country manager only authorises expenditures up to a certain threshold and that all other expenses are pre-approved by the headquarters. They verify, for example, that internal control and risk management systems are followed.

While external auditors generally are free to examine every aspect related to accounting, management can define specific areas they want internal auditors to focus on. Hence, there are various types of internal audits, for example, security, IT and process audits.