Internal Audit & Assurance Maturity Assessment

About this model

About this assessment

About the Internal Audit & Assurance maturity model

Boards and leaders need to know whether the organisation's controls actually work and whether its most important risks are being managed. Internal audit and other assurance functions exist to answer that question objectively. When they work well, they spot problems before they become crises and help management improve. When they don't, they become a compliance ritual: testing the same low-risk controls every year, producing long reports that change nothing, and offering false comfort.

This model looks at internal audit and assurance through the eyes of the people who rely on it. Is the function independent and properly mandated? Does it focus on the risks that matter most? Is its work rigorous and its evidence sound? Are its findings clear, and are they actually fixed? Does it have the skills to audit modern risks such as cyber, data and culture? And is assurance coordinated across the organisation so that leaders get a complete picture without duplication or gaps? It applies equally to in-house teams, outsourced or co-sourced arrangements, and small organisations that rely on a few people to provide assurance.

The Internal Audit & Assurance maturity model contains 24 questions across 6 areas: mandate, independence and governance; risk-based planning; audit execution and evidence; reporting and follow-up; people, skills and resourcing; and quality, technology and assurance coordination. Each question describes three levels of maturity through concrete practices. It is designed for heads of internal audit, audit committee members, and leaders of organisations considering how much assurance they need.

Who this assessment is for

• Heads of internal audit and audit team members
• Audit and risk committee chairs and members
• Chief executives, finance directors and risk leaders who rely on assurance
• Compliance, quality and other second-line assurance teams
• Smaller organisations deciding how to obtain independent assurance

The three maturity levels

• Level 1 — Tick-Box: Internal audit, where it exists, works through a fixed rotation of compliance checks that rarely changes. Its independence is unclear, its plan is not linked to the organisation's key risks, and testing relies heavily on walkthroughs and sampling of familiar controls. Reports are long and descriptive, many findings remain open for years, and leaders see audit as a necessary cost rather than a source of insight.

• Level 2 — Risk-Based: Internal audit has a clear charter and reports independently to an audit committee. The audit plan is based on an assessment of the organisation's risks and is updated as risks change. Audits follow a consistent methodology with documented evidence, reports are clear and prioritised, and actions are tracked until they are closed. The team has the core skills it needs and its work is quality-reviewed.

• Level 3 — Trusted Advisor: Internal audit is a respected source of insight on the organisation's most significant and emerging risks. Planning is dynamic, audits use data analysis to test whole populations, and the function provides assurance on strategic change, culture and technology as well as traditional controls. Assurance across the organisation is coordinated so leaders get a complete, non-duplicated picture, and audit's recommendations lead to lasting improvement.

The 6 areas assessed

1. Mandate, Independence & Governance

The foundation of internal audit's authority and objectivity. This area covers the audit charter, reporting lines and independence from management, the relationship with the audit committee or equivalent body, and unrestricted access to people, records and information.

2. Risk-Based Audit Planning

How internal audit decides what to audit. This area looks at the link between the audit plan and the organisation's risks, the coverage of the full audit universe, the flexibility of the plan, and whether emerging and strategic risks receive attention.

3. Audit Execution & Evidence

How individual audits are carried out. This area covers the audit methodology, the quality of testing and evidence, the use of data analysis, and how efficiently audits are completed and engaged with.

4. Reporting & Issue Follow-up

How audit results are communicated and acted on. This area looks at the clarity and impact of reports, the rating of findings, the agreement and tracking of management actions, and how overall conclusions are provided to leaders and the board.

5. People, Skills & Resourcing

Whether internal audit is properly resourced and skilled. This area covers the adequacy of resources against the plan, the breadth of skills including specialist areas such as technology, the development of auditors, and the use of co-sourced or external expertise.

6. Quality, Value & Assurance Coordination

How internal audit assures its own quality and demonstrates value, and how it works with other assurance providers. This area covers internal and external quality assessment, measuring stakeholder value, coordination with risk, compliance and external audit, and the use of technology to improve the function.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

• IIA Global Internal Audit Standards — the professional standards for internal auditing issued by the Institute of Internal Auditors
• IIA Three Lines Model — a model describing roles in governance, risk management and assurance
• COSO Internal Control — Integrated Framework — a widely used framework for designing and evaluating internal control
• Public sector internal audit standards in your jurisdiction — for example the UK Public Sector Internal Audit Standards, which adapt professional standards for the public sector

Frequently asked questions