Internal Auditor NZ: Key Responsibilities Explained – Aurora Financials

As businesses grow, managing financial, operational and compliance risks becomes increasingly important. Strong internal controls can help organisations protect their assets, improve processes and make better-informed decisions. An internal auditor NZ businesses can rely on plays an important role in reviewing these areas and identifying opportunities for improvement.

Internal auditing is not limited to checking financial records. It can cover governance, risk management, internal controls, operational processes, technology, compliance and other areas that may affect an organisation’s ability to achieve its objectives.

For New Zealand businesses, an effective internal audit function can provide independent, objective insight into whether important processes and controls are working as intended.

What Is an Internal Auditor?

An internal auditor is a professional who independently evaluates an organisation’s governance, risk management and internal control processes.

Internal auditors may examine how financial transactions are processed, how risks are managed, whether policies are followed and whether business systems are operating effectively.

The Institute of Internal Auditors’ current Global Internal Audit Standards describe internal auditing as a function focused on providing risk-based and objective assurance, advice and insight to enhance and protect organisational value. The standards have been effective since 9 January 2025.

An internal auditor can work as an employee within an organisation or be engaged externally to provide internal audit services.

What Does an Internal Auditor Do?

The responsibilities of an internal auditor depend on the organisation and the scope of the internal audit plan.

Common areas of work include:

• Reviewing internal controls
• Assessing business risks
• Examining financial processes
• Reviewing compliance with policies and procedures
• Evaluating operational efficiency
• Assessing fraud risks
• Reviewing information technology controls
• Examining procurement and purchasing processes
• Reviewing payroll controls
• Reporting weaknesses to management or governance
• Following up on previously identified issues

An internal auditor does not simply identify problems. A well-designed internal audit function also helps management understand why an issue exists and where improvements may be possible.

Why Is Internal Auditing Important for New Zealand Businesses?

Businesses face a range of financial, operational and regulatory risks. As organisations become more complex, informal controls may no longer provide sufficient protection.

Internal auditing can provide an independent review of important business processes.

For example, an internal auditor may discover that the same employee can create a supplier, approve an invoice and authorise payment. This creates a potential control weakness because responsibilities are not adequately separated.

The internal audit process can highlight the issue and recommend a more appropriate approval structure.

The objective is not necessarily to replace management’s responsibilities. Instead, internal audit provides independent assurance and insight that can help management and governance teams make better decisions.

Internal Auditor vs External Auditor

Internal auditors and external auditors have different purposes.

An external auditor generally provides an independent opinion on financial statements. Their work is focused on obtaining sufficient appropriate audit evidence to support that opinion.

An internal auditor generally focuses more broadly on governance, risk management and internal controls.

Internal Auditor	External Auditor
Reviews risks, controls and business processes	Provides an independent opinion on financial statements
Often works throughout the year	Usually works according to an external audit timetable
Can review operational and non-financial areas	Primarily focuses on financial reporting and related audit requirements
Reports to management, the board or those charged with governance	Reports through the independent audit engagement
Can provide assurance and advisory insight	Provides an audit opinion within the scope of the engagement

The two functions can interact. New Zealand auditing standards address circumstances in which an external auditor considers using the work of internal auditors or obtaining direct assistance from internal auditors, subject to the applicable requirements.

However, internal audit and external audit should not be treated as interchangeable services.

What Areas Can an Internal Auditor Review?

Internal audit can be adapted to the specific risks and priorities of an organisation.

Financial Controls

An internal auditor may review controls surrounding:

• Cash receipts and payments
• Bank reconciliations
• Accounts payable
• Accounts receivable
• Payroll
• Expense claims
• Financial reporting
• Journal entries

The objective is to assess whether financial processes are appropriately controlled and whether there are weaknesses that could lead to errors or misuse of funds.

Operational Processes

Internal auditors can examine how efficiently key business processes operate.

For example, an organisation may review its purchasing process to determine whether approvals are appropriate, supplier information is controlled and unnecessary expenditure is being avoided.

Risk Management

Internal audit can assess whether significant business risks have been identified and whether appropriate controls are in place to manage them.

This can include financial, operational, technology, compliance, reputational and strategic risks.

Compliance

Internal auditors can review whether employees and business units are following relevant internal policies and specified requirements.

The exact scope depends on the organisation and the nature of the engagement.

Information Technology

Technology is increasingly important to business operations. Internal audit may therefore examine areas such as access controls, user permissions, system changes, data protection and information security processes.

The IIA’s current framework also includes subject-specific Topical Requirements. Its Cybersecurity Topical Requirement became effective on 5 February 2026, while the Third-Party Topical Requirement is effective from 15 September 2026.

The Internal Audit Process

Although every engagement is different, an internal audit commonly follows a structured process.

1. Risk Assessment

The internal auditor begins by understanding the organisation’s objectives and identifying areas where significant risks may exist.

This helps determine which processes should receive attention.

2. Audit Planning

An audit plan is developed based on the identified risks and the objectives of the engagement.

The scope may cover a specific department, process, system or business activity.

3. Understanding the Process

The auditor examines how the process currently operates.

This may involve reviewing policies, interviewing employees, observing procedures and examining relevant documentation.

4. Testing Controls

The auditor tests selected controls to determine whether they are appropriately designed and operating effectively.

Testing may involve reviewing transactions, approvals, system records or other evidence.

5. Identifying Findings

Where weaknesses are identified, the auditor documents the findings and considers their potential impact.

Findings can vary from minor process improvements to significant control deficiencies.

6. Reporting

The results are communicated to the appropriate management or governance stakeholders.

An internal audit report may explain the issue, its potential impact, the underlying cause and recommended action.

7. Follow-Up

Internal audit can subsequently review whether agreed corrective actions have been implemented.

This helps ensure that audit recommendations do not simply remain on a report but result in practical improvements.

The IIA’s Global Internal Audit Standards specifically address engagement planning, performing engagement work, communicating results and monitoring action plans.

Benefits of Hiring an Internal Auditor NZ Businesses Can Rely On

An effective internal audit function can provide benefits across different parts of an organisation.

Stronger Internal Controls

Regular reviews can identify weaknesses in financial and operational controls before they become larger problems.

Better Risk Management

Internal auditing can help organisations understand whether important risks are being identified and appropriately managed.

Improved Operational Efficiency

Internal auditors can identify unnecessary duplication, inefficient procedures and opportunities to improve business processes.

Fraud Risk Management

Internal audit can review controls designed to prevent and detect inappropriate activity.

Internal audit does not guarantee that fraud will be detected, but stronger controls and independent reviews can help reduce exposure to certain risks.

Better Governance

Internal audit can provide boards and governance teams with independent information about the effectiveness of important controls and processes.

Greater Accountability

Clear recommendations and follow-up procedures can encourage management teams to address identified weaknesses.

Should a Small Business Have an Internal Auditor?

Internal audit is not only relevant to large organisations.

Smaller businesses may not need a full-time internal auditor. However, they can still benefit from periodic independent reviews of important processes.

For example, a growing business could engage an external internal audit provider to review its payment controls, payroll process, accounting system access and purchasing procedures.

This can provide an independent perspective without the cost of maintaining a permanent internal audit department.

The scope and frequency can be adjusted according to the size, complexity and risk profile of the organisation.

Outsourced Internal Audit Services in New Zealand

Some businesses choose to outsource internal audit rather than employ a dedicated internal auditor.

Outsourced internal audit can provide access to specialist skills while allowing the business to request reviews when required.

This approach can be particularly useful for organisations that:

• Are growing rapidly
• Do not have a dedicated internal audit team
• Need specialist expertise
• Want an independent review of controls
• Are implementing new accounting or technology systems
• Need support with risk assessment
• Want periodic reviews rather than a full-time internal audit function

An outsourced internal auditor can work with management and governance teams while maintaining an appropriate level of objectivity.

How to Choose an Internal Auditor in New Zealand

When selecting an internal auditor NZ businesses should consider several factors.

Experience

Look for experience relevant to the organisation’s industry, size and risk profile.

Independence

Internal audit needs sufficient objectivity to provide meaningful assurance. The auditor should be able to evaluate processes without inappropriate influence from the people responsible for them.

Technical Knowledge

The internal auditor should understand risk management, controls, auditing techniques and relevant business processes.

Communication

Audit findings are only useful when they are communicated clearly. The auditor should be able to explain technical issues in practical business terms.

Understanding of Technology

Modern internal audit increasingly involves accounting systems, data analytics, cybersecurity and technology controls.

Reporting and Follow-Up

Ask how findings will be documented and how corrective actions will be monitored after the audit.

What Standards Do Internal Auditors Follow?

The Institute of Internal Auditors’ 2024 Global Internal Audit Standards provide the current international framework for the professional practice of internal auditing. They became effective on 9 January 2025 and contain five domains covering the purpose of internal auditing, ethics and professionalism, governance, management of the internal audit function and performance of internal audit services.

The standards emphasise principles such as integrity, objectivity, competence, confidentiality, appropriate governance and effective communication.

New Zealand organisations can use these globally recognised standards as a framework for developing and evaluating an internal audit function.

Internal Audit and Risk Management

Internal audit and risk management are closely connected, but they are not the same function.

Management is responsible for identifying and managing the organisation’s risks. Internal audit provides independent assurance and insight into whether governance, risk management and controls are appropriately designed and operating effectively.

This distinction is important because internal auditors should not take ownership of management’s risks or controls.

Instead, their independent perspective allows them to assess whether the organisation’s approach is working as intended.

Internal Audit and Fraud Prevention

Internal audit can contribute to fraud risk management by reviewing controls around areas such as payments, purchasing, payroll, inventory and access to financial systems.

For example, an internal audit may examine whether employees with access to supplier records can also approve payments.

If weaknesses are identified, management can introduce additional approval requirements or segregation of duties.

However, internal audit should not be viewed as the only defence against fraud. Effective fraud risk management generally requires appropriate controls, management oversight, employee awareness and clear reporting procedures.

How Aurora Financials Can Help

Aurora Financials can support New Zealand businesses with accounting and financial processes that contribute to stronger internal controls and more reliable financial information.

An independent review of accounting processes can help businesses identify control weaknesses, improve financial procedures and establish more consistent reporting practices.

For organisations that do not require a full-time internal audit team, outsourced or periodic internal audit support can provide an alternative approach.

Aurora Financials can work with businesses to understand their financial processes and identify areas where additional controls, documentation or monitoring may be beneficial.

Final Thoughts

An internal auditor NZ businesses engage can provide valuable independent insight into financial controls, risk management, governance and operational processes.

Internal auditing is broader than checking whether numbers are correct. It can help organisations understand whether their processes are appropriately controlled, whether risks are being managed effectively and where improvements may be possible.

Whether a business maintains an in-house internal audit team or engages an external provider, the key is to establish an internal audit approach that reflects its size, complexity and risk profile.

With regular reviews and appropriate follow-up, internal audit can become an important part of a business’s overall governance and risk management framework.

Frequently Asked Questions About Internal Auditor NZ

1. What is an internal auditor in New Zealand?

An internal auditor independently evaluates areas such as governance, risk management and internal controls within an organisation. Internal auditors can work directly for an organisation or be engaged externally.

2. What does an internal auditor do?

An internal auditor may review financial controls, operational processes, compliance, risk management, technology controls and fraud prevention measures. They report findings and may recommend improvements.

3. Is internal audit mandatory in New Zealand?

Whether an organisation needs an internal audit function depends on its circumstances, industry, regulatory environment and governance requirements. Not every business is required to maintain an internal audit department.

4. What is the difference between an internal and external auditor?

An internal auditor generally reviews an organisation’s governance, risk management and internal controls, while an external auditor provides an independent audit opinion on financial statements within the scope of the external audit engagement.

5. Can small businesses use internal audit services?

Yes. Small businesses can use periodic or outsourced internal audit services instead of maintaining a full-time internal audit department. The scope can be tailored to the business’s most significant risks.