Is internal audit required by law?

The requirement for an internal audit is not universally mandated by law. While internal audits are considered best practice for many organizations, especially those in regulated industries, there is no blanket legal obligation that applies to all companies. Internal audit serves to assess and improve the effectiveness of risk management, control, and governance processes; however, companies are not legally required to establish an internal audit function unless specific regulations apply, often depending on the jurisdiction and the type of organization.

In many countries, the requirement for internal audits is more strictly enforced for public companies due to regulatory frameworks such as the Sarbanes-Oxley Act in the United States, which aims to protect investors through improved accuracy and reliability in corporate disclosures. However, private companies or smaller enterprises might not have the same legal stipulations, allowing them more discretion in deciding whether to implement internal auditing practices.

Thus, the correct understanding is that the necessity for an internal audit truly varies based on specific laws and regulations relevant to certain types of organizations, but in general, an internal audit is not legally mandated for all.