Independent Assurance: Internal Audit, Compliance, and External Review Compared

Research Publication · No. 05

Assurance is the part of governance that assumes the reporting might be wrong. Three functions provide it: internal audit tests controls from inside, compliance tests conduct against rules in real time, and external review tests the institution from outside. They are often confused because all three verify, but they differ in what they test, when they test it, and to whom they answer.

This document is reference material for institutional and analytical understanding. It is not legal, financial, tax, or regulatory advice.

Scope and method

This publication compares the three functions at a framework level on three dimensions: object (what is tested), timing (before, during, or after the fact), and reporting line (where the function's independence is anchored).

Internal audit

Internal audit tests whether controls exist and operate, after the fact, on a sampled basis. Its independence is structural: it must report to the audit committee or board, not to the management whose controls it tests. An internal audit function reporting into operations is assurance in name only.

Compliance

Compliance tests conduct against external rules and internal policy, before and during activity, not after. It advises, monitors, and escalates. Its structural tension is proximity: close enough to the business to see it, independent enough to report against it.

External review

External auditors, regulators, and independent assessors test from outside the institution's hierarchy entirely. Their independence is the strongest and their context the thinnest: they see what documentation and sampling reveal, on an annual or event-driven cadence. External review complements internal functions; it cannot replace them.

The assurance map

A complete assurance map shows every material risk covered by at least one function, each function anchored outside the chain it tests, and findings that travel to a body empowered to act. Gaps cluster in predictable places: new activities not yet in audit scope, and compartments whose assurance was never separately arranged.

How this connects to the wider framework

Assurance is the third layer of the oversight stack; its coverage question is sharpest in ring-fenced compartments described in ring-fencing logic; and its findings close the loop of capital allocation governance.

Frequently Asked Questions

What is the difference between internal audit and compliance?

Internal audit tests controls after the fact and reports to the board; compliance tests conduct against rules in real time and works alongside the business.

Can external review replace internal assurance?

No. External review has the strongest independence but the thinnest context and slowest cadence; it complements internal functions rather than substituting for them.

What makes an assurance function independent?

Its reporting line: the function must answer to a body outside the chain of activity it tests, typically the audit committee or the governing board.