What is Internal Audit? Here are its duties, types, and salary!

Internal audit is an independent and objective assurance and consulting service inside an organization, used to assess and improve the effectiveness of governance, risk management, and control. The results are delivered to management and the board (directors, commissioners, or the audit committee) as a basis for improvement.

This article covers the internal audit function in an organization: its meaning, how it differs from external audit, its purpose, duties, types, position, reference standards, and estimated salary.

What is Internal Audit?

For issuers and public companies, POJK 56/POJK.04/2015 Article 1 point 1 defines internal audit as an independent and objective assurance and consulting activity, and Article 3 requires them to have an internal audit unit.

The global professional reference is the 2024 edition of the Global Internal Audit Standards (GIAS) from The IIA. The standards consist of five domains and 15 principles, and have been effective since January 9, 2025.

Terminology note: internal audit is also used for ISO internal quality audits, namely checking that a quality management system conforms to standards such as ISO 9001. This page covers the internal audit function in an organization. For quality audits, read ISO Internal Audit and Internal Quality Audit.

How Does Internal Audit Differ from External Audit and Internal Control?

These three terms are often confused. The table below compares them.

Internal audit is independent because of its position in the organization (the function reports to the board) and objective in its assessments. An audit of financial statements that results in an opinion is performed by a licensed Public Accountant under Law 5/2011.

See also:

• 7 Differences between Internal and External Audit, Let's Know!
• Internal Control: Definition, Purpose, Types, & COSO Components
• Internal Audit Unit: roles, tasks, and sops that must be known

What Are the Purpose and Functions of Internal Audit?

According to GIAS 2024, internal audit strengthens the organization's ability to create, protect, and sustain value by providing independent, risk-based, and objective assurance, advice, insight, and foresight. This function is carried out through two types of services:

• Assurance services: objective assessments to provide assurance, for example on compliance, finance, operations or performance, and technology.
• Advisory or consulting services: advice to stakeholders without providing assurance and without taking on management responsibilities.

Internal audit does not replace the internal control that management carries out. Improvements remain management's responsibility, while the auditor assesses and monitors the follow-up.

Approaches such as risk-based audit and continuous auditing help this function focus on the areas with the highest risk.

What are the duties of internal audit?

For issuers and public companies, POJK 56/POJK.04/2015 Article 7 sets the minimum duties and responsibilities of the internal audit unit as follows:

1. Prepare and carry out the annual internal audit plan.
2. Test and evaluate the implementation of internal control and the risk management system in line with company policy.
3. Examine and assess efficiency and effectiveness in finance, accounting, operations, human resources, marketing, information technology, and other activities.
4. Provide improvement suggestions and objective information about the activities examined at all levels of management.
5. Prepare audit result reports and submit them to the president director and the Board of Commissioners.
6. Monitor, analyze, and report on the implementation of the follow-up to the improvements that have been recommended.
7. Work together with the Audit Committee.
8. Prepare a program to evaluate the quality of internal audit activities.
9. Carry out special examinations when needed.

That list is the minimum requirement for issuers and public companies. Other organizations follow their own internal audit charter. At the level of a single engagement, the work is carried out through the eight steps below, which are mapped to the GIAS standards in the table that follows.

1. Gather Comprehensive Information About the Auditee

Auditee is the party, unit, or activity that is the subject of the audit. The auditor needs to understand it well, from how it works, its organizational structure, and its processes to the related reports, before assessing its risk (GIAS Standard 13.2).

2. Review Applicable Documents and Requirements

The auditor reviews the relevant documents and requirements, including policies, procedures, and regulations. The results of this review are used to set the engagement objectives, scope, and evaluation criteria (GIAS Standard 13.3 and 13.4).

3. Plan the Audit Program in Detail

An engagement comes from the annual audit plan, which is prepared on a documented risk assessment performed at least once a year (GIAS Standard 9.4). For each engagement, the auditor prepares a work program containing the procedures needed to achieve the engagement objectives (Standard 13.6) and communicates with the auditee so that the schedule and data needs are clear. The aim is to improve, not merely to find mistakes.

4. Create Checklist Audit

A checklist, or list of questions, is a tool within the work program that helps the auditor and the auditee prepare the data needed. A checklist does not replace the auditor's professional judgment. See internal audit checklist examples for an illustration.

5. Performing Testing and Analysis

The auditor gathers information, analyzes it, and then evaluates potential findings against the criteria that have been set (GIAS Standard 14.1 to 14.3). Even with a checklist, the auditor still needs to examine carefully every aspect related to the engagement objectives.

6. Collecting and Analyzing Audit Evidence

Every finding must be supported by sufficient evidence and documented in the engagement workpapers (GIAS Standard 14.6), so that audit results are accurate and accountable. Learn about their types and characteristics in audit evidence.

7. Reporting Audit Findings

The auditor delivers findings along with recommendations, or agrees on action plans with management, including their implementation schedule (GIAS Standard 14.4). The final result is communicated in a audit report that contains the objectives, scope, recommendations or action plans, and conclusions (Standard 15.1).

8. Monitoring Follow-Up

Internal auditors monitor follow-up to make sure recommendations or action plans are actually carried out by management (GIAS Standard 15.2). For issuers, this is also a duty of the internal audit unit under POJK 56/POJK.04/2015 Article 7 letter f. Why findings get ignored, and how to fix it, is covered in follow-up on audit findings.

See also:

• Complete Guide to the stages of Internal and external Audit
• The importance of Audit planning and its steps in the examination
• Audit Program (Internal Audit Work Program): Definition, Types, Examples, and How to Prepare One
• Quality standards of Internal Audit Reports and their important components

What are the types of internal audit?

The following are common examples of internal audit types. The list is not closed: POJK 56/POJK.04/2015 Article 7 letter c lists finance, accounting, operations, human resources, marketing, information technology, and other activities, while the GIAS glossary gives examples of assurance on compliance, finance, operations or performance, and technology.

1. Financial Audit

Financial Audit aimed at assessing the accuracy and reliability of the company's financial information.

In this type, internal auditors examine transactions, records, and financial statements to verify compliance with accounting principles and company policy. The result is assurance for management and the board, not an opinion on the financial statements as expressed by a Public Accountant.

2. Compliance Audit

Compliance Audit focuses on checking the company's level of compliance with applicable regulations, laws, internal policies, and tax regulations.

3. Operational Audit

An operational audit aims to evaluate the efficiency and effectiveness of a company's operations by reviewing business processes, operational procedures, and resource utilization.

4. Human Resources (HR) Audit

HR audits are conducted to assess the company's HR management practices, including compliance with labor regulations, payroll policies, and performance evaluation systems.

5. Information Technology (IT) Audit

IT audits are conducted to evaluate the security and effectiveness of a company's information systems which involves assessing security policies, access controls, and compliance with IT standards.

Besides those five types, internal audit can also cover fraud audits, which are discussed in fraud audit. Risk-based audit is an approach to setting priorities, not a separate type of audit.

What Is the Position and Independence of Internal Audit in an Organization?

Domain III of GIAS 2024 governs the internal audit function through three principles: authorized by the board (Principle 6), positioned independently (Principle 7), and overseen by the board (Principle 8). The internal audit charter sets out the function's purpose, mandate, and organizational position (Standard 6.2), and the chief audit executive confirms organizational independence to the board at least once a year (Standard 7.1).

At issuers and public companies, POJK 56/POJK.04/2015 provides that the head of the internal audit unit is appointed and dismissed by the president director with the approval of the Board of Commissioners and is accountable to the president director (Article 5). The unit is authorized to access information and communicate directly with the Board of Directors, the Board of Commissioners, and the Audit Committee (Article 8), and its charter contains a prohibition on holding concurrent operational duties (Article 9 letter g).

These two sets of provisions are used side by side. The details of reporting relationships are adjusted to each organization's internal audit charter.

In government agencies, internal oversight is carried out by the government internal supervisory apparatus (APIP) through audits, reviews, evaluations, monitoring, and other oversight activities (Government Regulation 60/2008 Articles 48 and 49). It is discussed in public sector internal audit.

See also:

• Code of Ethics for Internal Auditors: 5 GIAS 2024 Principles and Ethical Dilemma Examples

What Standards and Rules Does Internal Audit Follow?

• GIAS 2024 from The IIA: five domains (Purpose of Internal Auditing, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services) with 15 principles, effective since January 9, 2025. The IIA provides an official Indonesian translation.
• Ethics: Domain II of GIAS contains five principles, namely integrity, objectivity, competency, due professional care, and confidentiality.
• Issuers and public companies: POJK 56/POJK.04/2015 on the establishment and guidelines for preparing the internal audit unit charter.
• Other financial services sectors, such as commercial banks, have their own POJK, for example POJK 1/POJK.03/2019 for commercial banks.
• Government agencies: Government Regulation 60/2008 on the government internal control system.

The standards for external audits of financial statements are different: the Audit Standards (SA) issued by IAPI and Law 5/2011 on Public Accountants. A more detailed explanation of the framework in Indonesia is in internal audit standards in Indonesia.

References:

• Global Internal Audit Standards 2024 (The IIA)
• GIAS 2024 Indonesian translation (The IIA)
• The IIA press release on the effectiveness of GIAS
• POJK 56/POJK.04/2015 (BPK)
• Government Regulation 60/2008 (JDIH Kemenkeu)
• Law 5/2011 on Public Accountants (JDIH Kemenkeu)

How much does an internal auditor earn?

After understanding the meaning, duties, and types of internal audits, you may be curious about the salary of an internal auditor. 

Salary is influenced by experience, industry sector (finance, manufacturing, technology), location, company size, and job level (junior, senior, manager).

There is no official salary data for internal auditors in Indonesia. The figures below are estimates from secondary sources as of October 2026 and do not specifically distinguish internal auditors.

LokerID combines internal and external audit positions, while KantorKu covers auditors in general, so both are only an initial picture. Compare them with the latest job postings and the size of the target organization.

See also:

• Get to know the work of an Internal Auditor and the skills that must be owned
• Internal Audit Staff: duties, skills and qualifications required

How Can Software Help Manage Internal Audit?

Application Audithink from Sekawan Media is customizable internal audit management software. Its features include risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. These features relate to steps 3, 4, 7, and 8 in the table above, namely the audit plan and work program, reporting, and follow-up monitoring. The audit itself is still carried out by your organization's internal auditors.

If you're interested, hurry schedule an app demo or discuss first with product expert us now!

FAQ About Internal Audit

Read also — internal audit applications by industry:

• Internal Audit Application for State-Owned Enterprises: A Guide for SPI & APIP
• Bank Internal Audit Application: Guide to Features, Benefits, and How to Choose
• Manufacturing Audit Application: Guide to Features, Benefits, and How to Choose
• Mining Audit Application: A Solution for Managing Minerba SMKP Audits
• Plantation Audit Application: A Guide to Features, Benefits, and How to Choose
• Oil and Gas Audit Applications: A Guide to Features, Benefits, and How to Choose