What is an internal audit function?
An internal audit function is a function that exists permanently, plans on a risk basis over several years and is positioned so that it may judge the areas responsible for day-to-day business. It provides assurance and advice on governance, risk management and controls across the whole organisation and reports to management and the governing body. In the Three Lines Model of the Institute of Internal Auditors (IIA) it is the third line; it fits within the wider frame of GRC.
The benchmark is the IIA's Global Internal Audit Standards, applicable since 9 January 2025. They require an internal audit function that is independently positioned and reports directly to the governing body. In Germany, the Deutsches Institut für Interne Revision (DIIR) also issues its own internal audit standards.
Internal audit function or internal audit?
The two terms mean different things. An internal audit is an activity within a management system, for example under ISO/IEC 27001; the internal audit function is a function of the organisation.
| Feature | Internal audit function | Internal audit under a management system standard |
|---|---|---|
| Nature | permanent function | activity within a management system |
| Subject | governance, risk management and controls of the whole organisation | conformity and effectiveness of the management system concerned |
| Yardstick | professional standards and the audit plan | the standard and the organisation's own requirements |
| Reports to | governing body and executive management | those responsible for the management system, top management |
An existing internal audit function can take over the internal audits of a management system if it has the necessary competence for the subject and is independent. Conversely, an annual ISMS audit does not replace an internal audit function, because it looks only at the management system.
Where does the law require an internal audit function?
There is no general legal duty for all companies; legal form, sector and supervisory law decide.
| Requirement | Provision | What applies |
|---|---|---|
| Listed German stock corporations | § 91(3) of the German Stock Corporation Act (AktG) | The management board sets up an appropriate and effective internal control system and risk management system; the provision does not expressly name an internal audit function. |
| Audit committee | § 107(3) sentence 2 AktG | If the supervisory board appoints an audit committee, it deals among other things with the effectiveness of the internal audit system. |
| Credit institutions | § 25a(1) of the German Banking Act (KWG), number 3 of the list | internal control procedures with an internal control system and an independent internal audit function; details in MaRisk. Under § 25d(8) and (9) KWG the chairs of the risk and audit committees may obtain information directly from the head of internal audit |
| Insurance undertakings | § 30 of the Insurance Supervision Act (VAG) | an effective internal audit function that reviews the entire business organisation; objective and independent of operational activities; reports directly to the management board |
| Financial entities under DORA | Article 6(6) and (7) of Regulation (EU) 2022/2554 | The ICT risk management framework is subject to internal audit on a regular basis, except at microenterprises; a formal follow-up process for the findings has to be established. |
Is your internal audit function really independent? A test grid
Test how your internal audit function is set up with five questions. Each answer needs evidence that an audit committee could also see.
| Question | Expected answer | Evidence |
|---|---|---|
| To whom does the head of internal audit report? | under the IIA Standards, directly to the governing body or its audit committee; under German supervisory law, to management (MaRisk AT 4.4.3 para. 2, § 30(2) VAG); at credit institutions the governing body receives the regular audit reports (MaRisk AT 3.2 para. 2) | rules of procedure or audit charter |
| Does internal audit have unfiltered access to people, systems and data? | yes, without approval by the area under review | charter, record of read access rights |
| Does anyone review matters they were responsible for themselves? | no; exceptions are disclosed to the governing body | independence declarations per audit |
| What is the audit plan derived from? | the current risk situation, agreed with the governing body; at credit institutions, management approves it (MaRisk AT 4.4.3 para. 6) | audit plan with risk rationale and minutes of the agreement |
| What happens to findings? | each has an owner, a deadline and follow-up | action list with status and re-check |
If an answer differs, the objectivity of internal audit is impaired in fact or in appearance. Disclose the impairment to the governing body and record how you will remedy it.
Topical Requirements: mandatory content for specific topics
Since 2025 the IIA has added Topical Requirements to the Standards: minimum requirements for engagements on a specific risk area, required for assurance engagements and recommended for advisory work. Each becomes effective 12 months after it is issued.
| Topical Requirement | effective |
|---|---|
| Cybersecurity | since 05.02.2026 |
| Third-Party | since 15.09.2026 |
| Organizational Behavior | from 15.12.2026 |
| Organizational Resilience | from 30.04.2027 |
For internal audit functions that work to the IIA Standards, assurance engagements on cybersecurity and on third parties are therefore already subject to the Cybersecurity and Third-Party Topical Requirements (as of October 2026).