Primary navigation:

QFINANCE Quick Links
QFINANCE Reference

Home > Auditing Best Practice > The Assurance versus Consulting Debate: How Far Should Internal Audit Go?

Auditing Best Practice

The Assurance versus Consulting Debate: How Far Should Internal Audit Go?

by Michael Parkinson

Executive Summary

  • The internal audit function of most organizations contains highly qualified and experienced individuals who, over a number of years, develop a detailed understanding of the organization’s risks and operations.

  • Thus, when a complex business risk issue emerges, the internal auditors may be well placed to help address it.

  • Under these circumstances, does the short-term advantage of using the internal auditors as consultants to address the problem outweigh the longer-term cost of potentially compromising the level of assurance provided to the board and top management?

Internal Audit

Internal auditors have described their discipline as an “assurance and consulting activity.” Such a definition immediately begs the question: what is the difference, and what should the balance be?

Assurance has been variously defined. The dictionary definition, “a statement or indication that inspires confidence,” differs quite considerably from the statement to be found in Assurance Standards (quoted here from the Australian Assurance Standards Board): “[the level of] satisfaction as to the reliability of information provided. The degree of satisfaction achieved is determined by the nature and extent of procedures performed by the auditor, the results of procedures and the objectivity of the evidence obtained.” The high standards of evidence and the limited range of reports that flow from this latter definition are a long way from the resource commitment and the kind of reports that most managers want from their internal auditors. Most managers are seeking something more akin to the first definition, but they want to retain the reliability provided by objective, evidence-based reviews.

Consulting, on the other hand, is generally accepted as meaning the provision of professional advice. It implies an underlying professional competence that is used in making judgments about a given situation and relied on by the user of the consultant’s advice.

While the description of internal auditing set out above is widely accepted, it is not the only definition to be found. Many internal auditors omit “consulting” from their scope, believing that providing advice impedes their objectivity. Others assess their value to the organization by the volume of consulting requests that they receive from management.

There are two risks to the organization reflected in this issue: excess levels of consulting may compromise the assurance that the organization requires, but prohibiting consulting work may prevent the organization from using the skills and experience of the internal auditors to solve business problems.

Back to Table of contents

Further reading


  • Fraser, John, and Hugh Lindsay. 20 Questions Directors Should Ask About Internal Audit. Toronto, ON: Canadian Institute of Chartered Accountants, 2007.
  • Reding, K. F., P. J. Sobel, U. L. Anderson, M. J. Head, S. Ramamoorti, and M. Salamasick, with C. Riddle. Internal Auditing: Assurance and Consulting Services. Orlando, FL: IIA Research Foundation, 2007.


Back to top

Share this page

  • Facebook
  • Twitter
  • LinkedIn
  • Bookmark and Share