Good Practices for Internal Audit & Control in Organisations

In 2026 UK organisations operate in a landscape shaped by persistent cyber threats, mandatory ESG reporting (under the UK Sustainability Disclosure Standards aligned with IFRS S1/S2), the full implementation of the Operational Resilience rules (FCA/PRA), increasing use of generative AI, supply-chain vulnerabilities exposed by geopolitical tensions, and evolving regulatory expectations from the FRC, ICAEW, and IIA UK & Ireland. Effective internal audit and internal control functions are now strategic assets—providing not only assurance but foresight, value-add insights, and resilience support.

The COSO Internal Control – Integrated Framework (2013, with 2023 supplemental guidance on ESG and emerging risks) and the IIA Global Internal Audit Standards (effective 2025 onwards) remain the global benchmarks. UK-listed companies must align with the UK Corporate Governance Code (updated 2024), requiring boards to monitor risk management and internal controls explicitly. This extended guide (over 2200 words) details current good practices, implementation steps for SMEs vs large organisations, key focus areas in 2026, common pitfalls, and ten practical FAQs to help finance, risk, and audit leaders strengthen their systems.

1. Core Foundation: Applying the COSO Internal Control Framework in 2026

COSO organises internal controls into five integrated components with 17 principles.

Control Environment Good practice: Embed ethical tone at the top with visible board commitment.

• Documented values, code of conduct, anti-bribery & corruption policy (UK Bribery Act compliance)
• Clear governance structure, defined authorities, segregation of duties (SoD) enforced via access controls
• Annual ethics training + anonymous whistleblowing hotline (Speak Up channels mandatory for listed firms)
• SMEs: Owner-led culture with simple policies; large firms: independent audit committee oversight

Risk Assessment Good practice: Shift to dynamic, continuous risk identification.

• Enterprise risk register updated quarterly or on trigger events (cyber incident, regulatory change)
• Explicit coverage of emerging risks: AI governance & bias, third-party cyber exposure, climate-related physical & transition risks, operational resilience (important business services)
• Fraud risk assessment annually (per COSO & IIA)
• Use scenario analysis, stress testing, and horizon scanning for black-swan events

Control Activities Good practice: Layer preventive, detective, and corrective controls with automation priority.

• Automated workflows (approvals, reconciliations, three-way matching)
• Strong IT general controls (ITGC): access management (MFA, privileged access monitoring), change management, backups & disaster recovery
• Physical security, segregation of duties matrices, exception reporting
• ESG data controls: source validation, calculation methodologies, assurance over Scope 1–3 emissions

Information & Communication Good practice: Ensure accurate, timely, secure flow of information.

• Real-time dashboards (Power BI, Tableau) for key risk indicators (KRIs) and key control indicators (KCIs)
• Structured training & communication of control responsibilities
• External ESG reporting with internal sign-off and data lineage documentation

Monitoring Activities Good practice: Blend ongoing management monitoring with independent evaluations.

• Continuous automated monitoring of transactions/controls
• Management self-assessment (CSA) questionnaires
• Internal audit remediation tracking via GRC platforms (e.g., Archer, MetricStream, ServiceNow)

2. Good Practices Specific to Internal Audit in 2026 (IIA Global Standards)

The IIA Standards emphasise purpose, ethics, governance, performance and quality.

Risk-Based & Agile Audit Planning

• Develop thematic, flexible plans prioritising highest residual risks
• Mandatory coverage: cybersecurity, third-party risk, AI/algorithmic governance, ESG assurance, operational resilience
• Rolling 12–24 month plans with quarterly refresh

Technology-Enabled Auditing

• Continuous auditing & AI-powered analytics for 100% coverage
• Process mining, anomaly detection, predictive risk scoring
• RPA for routine testing; auditors skilled in data analytics (SQL, Python), cyber basics, AI ethics

Expanded Role & Combined Assurance

• Provide advisory insights on emerging risks while preserving independence
• Coordinate with second line (risk/compliance) and external audit for combined assurance
• Thematic reviews: culture & conduct, change management, resilience testing

Reporting & Stakeholder Engagement

• Concise, insight-led reports: executive summaries, root-cause analysis, heat maps, remediation timelines
• Visual dashboards for boards & executive committees
• Regular one-on-one engagement with management & audit committee

Quality & Continuous Improvement

• Annual internal quality assessment + external every 5 years
• Track recommendation implementation & remediation timeliness
• Maintain audit knowledge base & lessons-learned repository

3. 2026 Priority Focus Areas

• Cybersecurity & Operational Resilience — Annual penetration testing, incident response plan tabletop exercises, third-party risk assessments, identity & access management (IAM) reviews
• ESG & Sustainability Assurance — Controls over non-financial data (emissions, diversity, modern slavery statements), alignment with UK SDS/TCFD
• AI & Emerging Technology Governance — Model risk management, bias & explainability testing, change controls for AI deployments
• Third-Party & Supply-Chain Risk — Due diligence, ongoing monitoring, contingency planning
• Fraud & Ethics — Data analytics for red-flag detection, whistleblower programme effectiveness

4. Practical Implementation: SMEs vs Large Organisations

SMEs (common in UK regions outside London)

• Pragmatic, cost-effective controls: owner review of key transactions, simple checklists, cloud-based tools (Xero, QuickBooks with add-ons)
• Focus on high-impact risks: cash, revenue recognition, procurement, payroll
• Periodic outsourced internal audit or peer reviews via ICAEW/FSB networks
• Affordable GRC-lite platforms (e.g., Diligent Entities, SimpleRisk)

Large & Listed Organisations

• Enterprise-wide GRC platforms with workflow automation
• Three-lines model with clear role definitions
• Integration of internal audit into major programmes (ERP, AI adoption, ESG reporting)
• Board-level risk & audit committees with independent NEDs

5. Common Challenges & Solutions

• Resource constraints → Prioritise high-risk areas, leverage technology
• Resistance to change → Build psychological safety, demonstrate value through quick wins
• Keeping pace with risks → Quarterly risk refresh, horizon scanning, external benchmarking
• Over-documentation → Focus on effective controls, not excessive evidence

Frequently Asked Questions (FAQs)

1. What is the key difference between internal control and internal audit? Controls are the systems/policies to achieve objectives; internal audit independently evaluates effectiveness and provides assurance/advice.

2. Is COSO still the leading framework in the UK in 2026?

Yes—widely used alongside FRC guidance and UK Corporate Governance Code requirements.

3. How often should internal audit plans be refreshed? Annually formal; many leading teams use quarterly rolling updates for agility.

4. What technology is transforming internal audit right now? AI-driven continuous auditing, process mining, data analytics, and robotic process automation for scalable coverage.

5. Do SMEs need a full internal audit function? Not necessarily—periodic independent reviews, risk-based checklists, or outsourced services deliver strong value.

6. How do you measure internal control effectiveness? Management self-assessment, internal audit findings, external audit reliance, remediation closure rates, and KCI trends.

7. What role does internal audit play in ESG reporting? Assurance over data processes, calculation methods, disclosure controls, and alignment with UK SDS/IFRS S1/S2.

8. How should organisations address AI-related risks in controls? Establish AI governance frameworks, conduct model risk assessments, implement change & bias controls, and test explainability.

9. Is cybersecurity still a top audit priority? Yes—often mandatory under topical requirements; focus on resilience, third-party management, incident response.

10. What is one immediate step any organisation can take? Implement monthly management

review of key reconciliations, exception reports, and high-risk transactions with documented sign-off.

In 2026 strong internal audit and internal control practices are essential for UK organisations to navigate cyber, ESG, AI, and resilience challenges while creating value and maintaining stakeholder trust. Align with COSO and IIA Standards, leverage technology for efficiency, prioritise emerging risks, and foster collaboration across the three lines. SMEs can achieve robust controls cost-effectively with pragmatic approaches; larger entities should embed enterprise-wide systems and strategic audit input. Begin with a current-state gap assessment against these practices, prioritise quick wins (e.g., automated monitoring, ESG data controls), and build a multi-year maturity roadmap. In today’s uncertain environment, excellent governance is a competitive advantage—not a compliance burden.

Disclaimer: The information provided in this article is for general informational and research purposes only. Company details, features, services, and market positions may change over time. Readers are advised to visit official company websites and conduct independent research before making any business decisions or purchasing services.