ICAEW Registered Auditors  ·  90+ UK-Based Experts

Internal Audit

Independent, risk-based internal audit that tells your board what is actually working — outsourced, co-sourced or on demand, led by CMIIA-qualified professionals.

Internal audit exists to answer the question every board and audit committee must be able to answer: how do we know our risk management, controls and governance actually work? Management believing it is not enough — assurance has to be independent, evidence-based and reported without fear or favour.

We provide that assurance for organisations that are too small for a full in-house function, or whose in-house team needs additional capacity or specialist skills. Every engagement is led by professionals holding the Chartered Member of the Institute of Internal Auditors (CMIIA) qualification, with more than 20 years of internal audit experience across corporate, public sector and not-for-profit organisations.

Outsourced, Co-Sourced or Ad Hoc — Which Model Fits?

Fully outsourced: we act as your internal audit function — building the risk-based audit plan, delivering the audits, tracking management actions and reporting to your audit committee. You get a complete, professional function without the cost and recruitment risk of building one in-house.

Co-sourced: your in-house team keeps ownership while we supply what it lacks — specialist skills such as IT, cyber, fraud or contract audit, surge capacity to keep the plan on track, or independence for audits your team is too close to.

Ad hoc: single reviews of a specific risk, process or incident, mobilised quickly, with the same standards and reporting discipline as a rolling programme.

A Genuinely Risk-Based Plan

An internal audit plan should be built from your risk register and strategic objectives, not a recycled checklist. We work with the audit committee and executive to map the organisation's key risks, weigh existing sources of assurance, and target audit work where uncertainty is highest — so every audit answers a question the board actually needs answered. Plans are revisited during the year as risks move, not filed in January and followed blindly.

Reporting Your Audit Committee Can Use

Each audit concludes with a clear opinion, findings ranked by risk, and management actions agreed with owners and dates. For the audit committee we provide progress reporting against the plan, tracking of overdue actions, and an annual internal audit opinion on the organisation's framework of governance, risk management and control — the anchor point for the board's own assurance statements, including internal controls declarations under the UK Corporate Governance Code.

Standards and External Quality Assessment (EQA)

Our work is aligned with the Global Internal Audit Standards, which took effect in January 2025 and sharpen expectations of internal audit quality, independence and board engagement. The Standards also require internal audit functions to undergo an external quality assessment at least once every five years. We support in-house functions on both sides of that requirement: preparing for an EQA, and providing independent assessment and improvement recommendations.

What an Engagement Looks Like

Every audit follows a disciplined cycle: planning and scoping agreed with the sponsor; fieldwork combining interviews, walkthroughs, sample testing and data analysis; findings validated with management before reporting, so there are no surprises; and a final report with a clear opinion and agreed actions. We then follow up until actions are closed — because assurance that stops at the report changes nothing.

What You Get With Acumon

  • Fully outsourced internal audit function with audit committee reporting
  • Co-sourced support: specialist skills, surge capacity and independence on demand
  • Risk-based audit plans built from your risk register, not a recycled checklist
  • Clear opinions with findings ranked by risk and actions tracked to closure
  • Annual internal audit opinion to anchor board assurance statements
  • Alignment with the Global Internal Audit Standards
  • External quality assessment (EQA) preparation and independent review

Why Acumon for Internal Audit?

  • Chartered Member of the Institute of Internal Auditors (CMIIA) qualifications
  • 20+ years of internal audit experience
  • Outsourced, co-sourced and ad-hoc engagement models

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.

Common Questions

Frequently Asked Questions

What is the difference between internal and external audit?
External audit gives an independent opinion on your financial statements, primarily for shareholders, once a year. Internal audit works for the board and audit committee year-round, providing assurance over risk management, internal controls and governance across the whole organisation — operations, IT, compliance and culture, not just financial reporting. Well-run organisations use both, for different questions.
Do we need an internal audit function?
The UK Corporate Governance Code expects audit committees to review the need for one annually where none exists, and regulators, funders and lenders increasingly ask the same question. In practice the trigger is scale and complexity: once the board can no longer see for itself whether controls work, it needs independent assurance. Outsourcing makes that affordable long before an in-house team would be justified.
What does co-sourced internal audit mean?
Your in-house function retains ownership of the plan and relationship while we supply defined elements: specialist audits (IT, cyber, fraud, contracts), extra capacity when the plan slips, or independence where your team is conflicted. It is the most flexible way to raise coverage and quality without expanding headcount.
What is an external quality assessment (EQA) and how often is it required?
An EQA is an independent review of an internal audit function's conformance with professional standards and its overall effectiveness. The Global Internal Audit Standards require one at least every five years. We both prepare in-house functions for their EQA and deliver independent assessments with practical improvement recommendations.
How quickly can an internal audit engagement start?
Ad-hoc reviews can typically be scoped and mobilised within days, with senior resources available for immediate engagement. Establishing a full outsourced function takes a little longer because it starts with risk assessment and audit planning — but the first audits are usually underway within weeks, not months.
Who will actually do the work?
Professionals holding the Chartered Member of the Institute of Internal Auditors (CMIIA) qualification, with more than 20 years of internal audit experience across corporate, public sector and not-for-profit organisations. Engagements are senior-led throughout — your audit committee deals with the people doing the work, not an account manager.
Get in Touch

Ready to Sort Your Internal Audit?

Tell us what you need. Within one business day, a qualified accountant will be in touch to talk it through and give you a clear, fixed-fee quote — no obligation.

Visit us1-2 Craven Road, Ealing, London, W5 2UA

Speak to a Specialist

Fill this in and we'll come back to you within one business day.

No obligation. Your details stay private.
Call Now Get in Touch