What an internal audit actually does
An internal audit is an independent, objective assessment of your business’s operations, controls, and governance processes. It is not a financial statement audit. It is not a compliance check. It is a systematic evaluation of whether your business is doing what it says it is doing, and whether the controls you have in place are working.
For SMEs, internal audits typically cover:
- Financial controls: Are payments properly authorised? Are bank reconciliations done monthly? Are there segregation of duties?
- Operational controls: Are inventory counts accurate? Are procurement processes followed? Are contracts properly managed?
- Compliance: Are you meeting your tax, labour, and regulatory obligations?
- Risk management: Are the biggest risks to your business identified and managed?
The internal audit function is particularly valuable for businesses that are growing. As a business scales, the informal controls that worked when the owner knew every transaction no longer suffice. Processes need to be formalised, documented, and tested.
Why SMEs need internal audits
Risk management
Every business faces risks: fraud, cash flow problems, regulatory non-compliance, operational failures, key-person dependency. An internal audit identifies which risks are most significant and whether the controls in place are adequate.
For SMEs, the most common risks are:
- Cash flow shortages due to poor debtor management
- Fraud from inadequate segregation of duties
- Regulatory non-compliance (tax, labour, POPIA)
- Over-reliance on key employees
- Inadequate insurance coverage
- Supplier concentration risk
An internal audit does not eliminate these risks, but it makes them visible and manageable.
Process improvement
Internal auditors do not just look for problems. They also identify opportunities to improve processes, reduce waste, and increase efficiency. This is particularly valuable for growing businesses that are scaling their operations.
Common improvement areas:
- Automating manual processes
- Streamlining approval workflows
- Reducing duplication of effort
- Improving documentation and record-keeping
- Strengthening vendor management
Investor and bank readiness
Banks and investors increasingly ask for evidence of strong governance and internal controls before providing funding. An internal audit demonstrates that your business takes risk management seriously and has the processes in place to support growth.
When an investor or bank asks “do you have internal controls?” the answer should be more than a statement of intent. An internal audit report provides documented evidence that controls exist, have been tested, and are effective.
Credibility with stakeholders
An internal audit report adds credibility to your financial information and governance processes. It tells customers, suppliers, and regulators that your business is well-managed and that risks are being actively managed.
When to start
The right time to establish an internal audit function is before you need it. If your business is:
- Growing rapidly and processes are becoming more complex
- Approaching R10 million or more in annual turnover
- Seeking external funding or investment
- Expanding into new markets or product lines
- Hiring more employees and delegating more responsibility
- Facing increased regulatory requirements
If any of these apply, an internal audit should be part of your governance framework.
How often
For SMEs, an internal audit is typically performed annually. Some businesses with higher risk profiles may benefit from semi-annual reviews. The frequency depends on the size and complexity of the business, the industry, and the regulatory environment.
What an internal audit report contains
The internal audit report typically includes:
- Scope and objectives of the audit
- Methodology used
- Findings (control weaknesses, non-compliance, process gaps)
- Risk ratings for each finding
- Recommendations for improvement
- Management’s response and action plan
The report should be practical and actionable. It should not just identify problems but provide specific recommendations that the business can implement.
Internal audit vs external audit
Both are valuable, but they serve different purposes. An external audit focuses on the accuracy of your financial statements. An internal audit focuses on the effectiveness of your controls and processes.
The bottom line
Internal audits are not just for large companies. Growing SMEs need them to manage risk, improve processes, and demonstrate governance to investors and banks. The cost of an internal audit is modest compared to the cost of a fraud loss, a regulatory penalty, or a failed funding application.
If your business is growing, an internal audit should be part of your governance framework. It provides the independent assessment you need to manage risk and support growth.
SC Audit is an IRBA-registered audit firm based in Bellville, Cape Town. SC Audit’s partners Niel Schoeman, Simone Coetzee, and Hennie Meyer support growing businesses with internal audits, risk assessments, process reviews, and governance frameworks. Contact SC Audit to discuss how an internal audit can support your business.
Frequently Asked Questions
Is an internal audit mandatory for private companies?
No. The Companies Act does not require private companies to have an internal audit function. However, banks, investors, and regulators may expect or require it as a condition of funding or as part of good governance.
What does an internal audit cost?
The cost depends on the scope and complexity of the audit. A basic internal audit for a small business may cost R30,000 to R80,000. A more comprehensive audit for a larger SME may cost R100,000 to R250,000. The cost is typically far less than the potential loss from a control failure or fraud.
How long does an internal audit take?
A basic internal audit for a small business may take two to four weeks. A more comprehensive audit may take six to twelve weeks. The timeline depends on the scope of the audit and the availability of information.
What is the difference between an internal audit and a compliance audit?
An internal audit covers a broad range of areas including operations, controls, compliance, and risk. A compliance audit focuses specifically on whether the business is meeting its regulatory obligations. An internal audit may include a compliance component, but it is broader in scope.
Can I do my own internal audit?
You can perform some internal audit activities yourself, such as reconciling bank statements or reviewing expense claims. However, a formal internal audit should be performed by an independent party, either an internal audit function or an external firm. Independence is essential for the findings to be credible.