Governance
Governance processes
"Evaluates the adequacy of governance structures, accountability to the governing body and the organization’s culture of integrity."
Internal audit: the third line of compliance assurance
We help you design and run the internal audit function as the third line of the Three Lines Model: independent assurance on governance, risk management and internal control, with a risk-based plan, reporting to the audit committee and an audit of the compliance system.
Free consultation
We reply within 24 h
- IIA Model principles
- 6 principles
- IIA Model published
- July 2020
- Audit committee (LSC)
- Art. 529 quaterdecies
- Compliance system standard
- ISO 37301
Services
How we work on your internal audit function
Six building blocks to design and run internal audit as the third line of assurance, from the charter and the risk-based plan to the audit of the compliance system and the follow-up of recommendations.
Function
Design of the internal audit function
We define the charter, mandate, organizational position and independence of internal audit as the third line within the Three Lines Model.
Learn more →
3rd lineCharterIndependenceIIA
Plan
Risk-based annual audit plan
We build the audit plan from the organization’s risk map, prioritizing the areas of greatest exposure and aligning it with its objectives.
Learn more →
Annual planRisksPrioritization
Reporting
Independence and reporting to the audit committee
We secure functional reporting to the governing body or the audit committee and unrestricted access, both key to independence.
Learn more →
CommitteeReporting
System
Audit of the compliance system
We carry out the internal audit of the compliance management system in line with ISO 37301 and UNE 19601, as part of performance evaluation.
Learn more →
ISO 37301UNE 19601
Criminal
Verification of the crime prevention model
We independently verify the effectiveness of the organization and management model, supporting its periodic review.
Learn more →
Art. 31 bis Criminal CodeModel
Follow-up
Follow-up of recommendations
We put in place the follow-up of recommendations and action plans, and coordinate with internal investigations where appropriate.
Learn more →
RecommendationsFollow-up
What it covers
What internal audit evaluates
The third line provides assurance on the adequacy and effectiveness of governance, risk management and control processes, and adds value through independent advice.
Risks
Risk management
"Reviews whether risk management properly identifies, assesses and treats the organization’s exposures, independently of management."
Control
Internal control
"Tests the design and operating effectiveness of the internal controls that mitigate the business’s material risks."
Compliance
Compliance system
"Audits the compliance management system (ISO 37301 / UNE 19601) and the effectiveness of the crime prevention model."
Why it matters
Why is internal audit key?
Without an independent third line, the governing body has no objective assurance that controls work. A well-designed internal audit protects the board and strengthens the credibility of compliance.
Without a third line, the board is flying blind: internal audit provides the independent assurance that neither management nor the control functions can give about themselves.
Confusing the 2nd and 3rd lines: compliance and risk management are part of management; internal audit must stay independent to keep its value.
Independence is easily lost: if internal audit takes on management tasks, it can no longer give objective assurance on those same activities.
Three Lines Model
6 principles
The IIA’s Three Lines Model (2020) rests on six principles and places internal audit as the third line.
LSC Art. 529 quaterdecies
Listed companies
At listed companies, the audit committee oversees the effectiveness of internal control, internal audit and risk management.
Recommendations
With follow-up
An audit without follow-up of its recommendations loses value: the cycle closes by verifying that deficiencies are corrected.
Does your organization need an internal audit function?
Whether you are starting from scratch or want to strengthen an existing function, we help you design it, give it independence and build a risk-based audit plan that gives the board real assurance.
Frequently asked questions
Internal audit: common questions
What is internal audit?
It is an independent and objective assurance and advisory function that evaluates the adequacy and effectiveness of governance, risk management and internal control processes, and adds value to the organization.
What is the Three Lines Model and where does internal audit fit?
It is the IIA framework (2020) that organizes roles: the first line manages, the second line controls and supports (compliance, risk) and the third line is internal audit, which provides independent assurance.
How does it differ from the 2nd line?
Second-line functions (compliance, risk management) are part of management. Internal audit stands out for its independence from management, which lets it give objective assurance.
How does it differ from a financial statement audit?
A financial statement audit (external) gives an opinion on the financial statements and is carried out by an independent external auditor. Internal audit is a function of the organization itself that covers governance, risk and control, not just financial matters.
Who does internal audit report to?
Functionally, to the governing body or the audit committee; administratively, to senior management. That reporting line and unrestricted access to people, data and resources safeguard its independence.
Is it mandatory?
At listed companies and public-interest entities, the audit committee must oversee internal audit (LSC Art. 529 quaterdecies). In general it is a good-governance recommendation, and in certifiable compliance systems (ISO 37301 / UNE 19601) internal audit of the system is mandatory.
What standards govern it?
The IIA’s International Standards for the Professional Practice of Internal Auditing and the Three Lines Model, supplemented by the CNMV Good Governance Code for listed companies.
Can it be outsourced?
Yes. The function can be outsourced in whole or in part (co-sourcing or outsourcing) to a qualified third party, while maintaining independence and reporting to the governing body.
Also asked
CAE, risk-based plan and assurance
What is the CAE (chief audit executive), or head of internal audit?
The chief audit executive is the executive in charge of the function. The CAE leads internal audit, proposes the plan and reports to the governing body or the audit committee.
What is a risk-based audit plan?
It is the plan that prioritizes audit engagements according to the risk level of each area or process, aligned with the risk map and the organization’s objectives.
Does internal audit provide “assurance” and “advisory” services?
Yes. It provides assurance services (objective evaluation to give an opinion) and advisory or consulting services (support to improve processes), always preserving its independence.
How are internal audit and the risk map related?
The risk map feeds the audit plan: the areas of greatest exposure are audited more often and in more depth. Audit, in turn, evaluates whether risk management works.
Do unlisted companies need one?
Not as a general rule, but it is highly advisable: it gives assurance to the management body and strengthens the compliance system, especially in organizations with material risks.
How does it relate to the crime prevention model?
Internal audit can independently verify the effectiveness of the organization and management model (Article 31 bis of the Criminal Code), supporting its periodic review and its credibility with third parties.
The Three Lines Model
First, second and third line: comparison
Understanding where each function fits avoids overlaps and gaps in coverage. We help you place internal audit and set it apart from the other lines.
What determines the scope of the project
Designing and running internal audit depends on the size of the organization, its risk profile and whether the function is kept in-house or outsourced.
- Function
- Charter, independence and organizational position.
- Plan
- Annual plan based on the risk map.
- Execution
- Number and complexity of audit engagements.
- Model
- In-house, co-sourcing or outsourcing.
How we work on the function
We start from the charter and independence, build the risk-based plan and leave the work cycle and follow-up up and running.
- Charter, mandate and independence of the function.
- Risk-based annual audit plan.
- Execution, reporting and follow-up of recommendations.
| Function | 1st line | 2nd line | 3rd line (internal audit) | External audit |
|---|---|---|---|---|
| Role | Managing and taking risk | Control and compliance | Independent assurance | Opinion on the financial statements |
| Independent of management | No | Partial | Yes | Yes (external) |
| Reports to | Management | Management | Governing body / committee | Shareholders’ meeting / audit committee |
| Example | Business operations | Compliance, risk management | Internal audit function | Statutory auditor |
| Reference framework | Internal procedures | Control policies | IIA Standards / Three Lines | Statutory audit regulations |
Illustrative table based on the IIA’s Three Lines Model (2020). The specific scope of each function depends on each organization’s structure and risk profile.
Operational guide
How to implement the internal audit function: a practical guide
A useful internal audit cannot be improvised: it needs a charter that guarantees its independence, a risk-based plan, methodical execution and a follow-up that closes the loop by verifying that deficiencies are corrected.
Define the function
The charter sets the purpose, authority and responsibility of internal audit, its independence and its reporting line to the governing body or the audit committee.
Plan and execute
The annual plan is built on the risk map. Engagements are carried out with a systematic, disciplined approach and end in reports with clear observations.
Report and follow up
Observations are communicated to management and the governing body, and recommendations are followed up until their implementation is verified.
Internal audit function checklist in 10 steps
- Charter: approve the internal audit charter and its mandate.
- Independence: set the reporting line to the governing body or the audit committee.
- Resources: provide the means, skills and unrestricted access.
- Risks: start from the organization’s risk map.
- Plan: draw up the risk-based annual audit plan.
- Program: design the program for each engagement (objectives and scope).
- Execution: obtain sufficient evidence and document the work.
- Report: issue conclusions, observations and recommendations.
- Follow-up: verify the implementation of the recommendations.
- Improvement: evaluate and improve the quality of the function itself.
If you want to design or strengthen your function, see our corporate compliance area or the risk map.
Internal audit in practice
From plan to follow-up of recommendations
The internal audit function rests on four components: plan on a risk basis, execute the work, report to governance and follow up on the recommendations. Here is the visual panel of how it works in practice.
1) PlanPlan: on a risk basis
The annual plan prioritizes areas and processes by their risk level, aligned with the risk map and the objectives.
- Risk map
- Annual plan
- Prioritization
2) ExecuteExecute: evidence and rigor
Each engagement defines objectives and scope, obtains sufficient evidence and documents the findings using a systematic approach.
- Work program
- Evidence
- Working papers
3) ReportReport: to governance
Observations and recommendations are communicated to management and the governing body to promote continuous improvement.
- Observations
- Recommendations
- Reporting to the committee
4) Follow upFollow up: close the loop
The value of audit is realized when recommendations are verified to have been implemented and deficiencies corrected. Follow-up closes the loop and feeds continuous improvement.
Tip: a recommendations log with an owner, deadline and status keeps findings from getting lost from one year to the next.
Quick decisionPractical map: in-house or external?
Organization with its own function
In-house internal audit, reporting to the committee.
Limited resources
Co-sourcing or outsourcing to a qualified third party.
Compliance system
Internal audit of the system (ISO 37301 / UNE 19601).
Internal audit playbook
The internal audit function, phase by phase
Charter
Approve the function’s mandate, independence and reporting line.
Approved internal audit charter.
Planning
Build the annual plan from the risk map.
Risk-based annual plan.
Execution
Carry out the engagements, obtain evidence and document findings.
Programs and working papers.
Reporting
Communicate observations and recommendations to governance.
Audit reports.
Follow-up
Verify the implementation of the recommendations.
Recommendation follow-up log.
Common mistakes in internal audit
Spot them before they erode the value of the function.
- Letting internal audit take on management tasks and lose its independence.
- Planning without starting from the organization’s risk map.
- Confusing the 2nd line (compliance, risk) with the 3rd line.
- Reporting to management instead of the governing body or committee.
- Issuing recommendations without a follow-up that closes the loop.
Operational glossary
Key internal audit concepts
If you are going to design or strengthen your internal audit function, these terms appear in the Three Lines Model and in the IIA standards. Understanding them helps you build a solid function.
Internal auditBasics
Internal audit function
Independent and objective assurance and advisory activity on governance, risk management and control.
Third line of the model.
3 LinesFramework
Three Lines Model
IIA framework (2020) that organizes the roles of governance, management and assurance around six principles.
Updates the “three lines of defense”.
3rd lineRole
Third line
Independent assurance role that falls to internal audit, separate from management’s responsibilities.
Independent of management.
CAERole
Chief audit executive
Head of the internal audit function; proposes the plan and reports to the governing body or the committee.
Leads the 3rd line.
AssuranceService
Assurance and advisory
Internal audit provides assurance services (objective opinion) and advisory services (support for improvement).
Assurance + advisory.
CharterMandate
Audit charter
Document that sets the purpose, authority, responsibility and independence of the function.
Approved by governance.
PlanRisks
Risk-based plan
Annual plan that prioritizes audit engagements according to the risk of each area or process.
Fed by the risk map.
CommitteeGovernance
Audit committee
Board committee that, at listed companies, oversees internal control, internal audit and risk management.
LSC Art. 529 quaterdecies.
IndependencePrinciple
Independence
Absence of interference and reporting to the governing body; key to objectivity, authority and credibility.
Safeguards the value of the function.
Contact
Book a call
Tell us how your internal audit function stands today and we will help you design it, give it independence and build a risk-based audit plan.
Internal audit framework: Three Lines Model, IIA Standards and audit committee
Internal audit is an independent and objective assurance and advisory function that evaluates the adequacy and effectiveness of an organization’s governance, risk management and control processes. Its international reference framework is the Standards of the Institute of Internal Auditors (IIA) and the Three Lines Model.
The Three Lines Model
In July 2020, the IIA published the Three Lines Model as an update of the former “three lines of defense” model, built on six principles. The first line manages and takes risk; the second line provides control and compliance (compliance, risk management); and the third line is internal audit, which provides independent and objective assurance and reports to the governing body and management to promote continuous improvement.
Independence and the audit committee
The independence of internal audit from management’s responsibilities is fundamental to its objectivity, authority and credibility, and it is safeguarded through reporting to the governing body and unrestricted access to people, data and resources. At listed companies, Article 529 quaterdecies of the Capital Companies Law (Ley de Sociedades de Capital) gives the audit committee responsibility for overseeing the effectiveness of internal control, internal audit and risk management systems, a criterion developed in CNMV Technical Guide 3/2017.
Internal audit and compliance
In compliance management systems, internal audit of the system is a mandatory part of performance evaluation under ISO 37301 and UNE 19601, and it can independently verify the effectiveness of the organization and management model for the purposes of Article 31 bis of the Criminal Code.