Ensuring integrity, effectiveness and public trust: Why internal audit matters for charities

The Charity Governance Code recommends internal audit for larger charities, and many well-established organisations in the sector already benefit from mature internal audit functions.

What does internal audit look like in the charity sector?

Internal audit is an independent, objective assurance and advisory function designed to support good governance, risk management and internal control. In the charity sector, it plays a key role in helping organisations assess how well they are managing their most important risks, including areas such as:

• Compliance with requirements from regulators such as the Charity Commission / Fundraising Regulator / Information Commissioner’s Office.
• Maximising Gift Aid contributions.
• Safeguarding vulnerable service users.
• Managing volunteer safety and wellbeing risk.
• Ensuring organisation impact reporting is accurate and transparent.
• Cybersecurity readiness.
• Detecting and preventing fraud.

These are not just technical or operational concerns - they relate directly to a charity’s ability to deliver on its mission, uphold public trust, and secure sustainable funding.

Generally, a good starting point for an internal audit is often the charity’s strategic risk register. Internal auditors can help ensure this reflects the real-world risks a charity faces, especially in a rapidly changing environment.

What do internal auditors do?

Internal auditors bring specialist knowledge in governance, risk management and control systems, with work typically including:

• Engaging with staff and trustees to understand how key risks should be managed - this includes exploring the organisation’s risk appetite.
• Reviewing policies and internal guidance to see if they align with expectations and best practice.
• Looking at real-life examples to assess whether processes are being followed effectively.
• Using data analysis to test systems and identify trends or anomalies that indicate whether the risk is being managed.
• Drawing on cross-sector experience to benchmark and assess whether risks are being over or under-managed.

The ultimate goal is to enhance a charity’s ability to manage risk and improve decision-making - not to ‘catch people out’, but to offer insight, evidence, pragmatic and practical recommendations that strengthen the organisation.

Internal audit work can take different forms:

• Assurance: a level of confidence, generally expressed through a traffic light (red-amber-yellow-green) opinion. Assurance reports also include a prioritised plan of improvement actions that have been agreed with you.
• Consulting: advice that is generally provided alongside you designing a new service or system, to improve your confidence that any risks will be managed. In this scenario, an opinion is not provided.

How can internal audit support your charity’s strategic objectives?

The charity sector faces a unique set of challenges. Many charitable organisations are navigating fluctuating funding, expanding service delivery, and increased scrutiny from regulators, donors, service users and the public. At the same time, there is an increasing need to act quickly and scale responsibly. Managing risk is therefore key to achieving success.

Internal audit supports this by:

• Strengthening internal processes, making them more resilient and adaptable.
• Supporting compliance with complex regulatory requirements.
• Offering early warning signs of issues such as fraud, poor safeguarding, or governance lapses.
• Enhancing the transparency and credibility of performance reporting.
• Supporting a culture of continuous improvement.

Perhaps most importantly, internal audit helps safeguard the public trust that charities depend on. With clear, evidence-based insight into how risks are managed, charities are better equipped to make confident decisions and deliver on their mission - sustainably, ethically, and effectively.