Internal audit is a key element of management’s responsibility to validate the strength of their internal controls. If internal audit is outsourced, best practice is to not use the same firm for the external audit engagement. Internal controls are the responsibility of line management.
Line managers must determine the level of risks they need to accept to run their businesses, and assure themselves that the combination of earnings, capital and internal controls is sufficient to compensate for the risk exposures.