Internal Audit

The regulatory context

Internal audit is the function that provides the board of directors and senior management with an independent and objective assessment of the effectiveness of governance, risk management and control processes. The professional benchmark is set by the Global Internal Audit Standards of the Institute of Internal Auditors, in force since 2025. They have replaced the mandatory elements of the previous International Professional Practices Framework (the Standards, the Code of Ethics and the Core Principles) and set requirements on independence, risk-based planning, communication of results and the quality of the function. For the design of the internal control system the reference model remains the COSO framework, alongside COSO ERM for enterprise risk management. Lastly, the IIA Three Lines Model clarifies the role of internal audit as the third line, distinct from the first- and second-line roles (operational management, risk management and compliance) that remain with management.

In Italy the function is provided for by the Italian Corporate Governance Code for those listed companies that adopt it, and by sector rules for banks, insurers and financial intermediaries. For all other companies the driver is the Italian Civil Code. Article 2086(2) requires anyone running a business in corporate or collective form to maintain organisational, administrative and accounting arrangements appropriate to the nature and the size of the business, including for the timely detection of business distress and of any loss of going concern (Italian Legislative Decree 14/2019, the Business Crisis and Insolvency Code). Article 2381 requires the executive directors to look after those arrangements and the board to assess their adequacy. Without an independent review of processes, that assessment rests above all on information supplied by those same executive directors: internal audit corroborates it with evidence gathered in the field.

Our approach

We deliver the function on an outsourced basis, taking on full operational responsibility for it, or on a co-sourced basis, alongside an in-house team that needs specialist skills or extra capacity. In both cases the mandate is formalised in an audit charter approved by the board: the document sets out scope, powers, reporting lines and independence rules. For listed companies, the Italian Corporate Governance Code expressly allows the function to be entrusted, in whole or for parts of its activity, to an external provider with adequate professional standing, independence and organisation, with the reasons for the choice explained in the corporate governance report.

We start from the audit universe: a structured inventory of the processes, companies, systems and suppliers that may be subject to review. We assess it for risk together with management, reusing the analyses already available so as not to ask the same questions twice. This produces the multi-year plan and the annual plan submitted to the board.

Engagements follow a written work programme: document review, interviews, process walkthroughs on site, testing of controls on defined samples, root cause analysis. Findings are discussed with the managers concerned before the report is drafted, so that recommendations are workable and already agreed. Follow-up is part of the service: we monitor how action plans are implemented and report periodically to the board, the control and risk committee and the board of statutory auditors.

We pay particular attention to coordination with the other control functions (the Supervisory Body, the external auditor, the DPO, management system owners), so that information flows are integrated and the company is not put through repeated reviews of the same processes.

What sets our service apart

• An auditable framework: the audit charter, the operating procedures, the function’s KPIs and the quality assurance programme are built on the Global Internal Audit Standards, so that the board and the statutory auditors can assess the work of the function and not only its results.
• Tracked follow-up: every finding goes into a register with an owner, a deadline and an implementation status; we check on site that corrective actions have been carried out and record the outcome in the periodic report to senior management.
• Findings that are useful to the board: reports separate what is urgent from what can be improved and give an overall opinion on the control system, rather than a simple list of anomalies.
• Flexibility: the arrangement (outsourcing or co-sourcing) and the intensity of engagements adapt year by year as scope and risks change, with no headcount commitments.