# Internal Audit vs External Audit vs SOX: Differences

Canonical: https://finbryn.com/us/guides/internal-audit-vs-external-audit-vs-sox

Internal audit tests an organization's processes and controls for management and the audit committee. An external audit is an independent public accounting firm's opinion on the financial statements, and SOX 404 is the SEC's internal control reporting rule for issuers. This guide, checked 2026-10-16, shows CFOs which applies, under IIA Standards effective January 9, 2025.

## Key takeaways

- Internal audit tests how the organization runs and reports to the board. An external audit is an independent firm's opinion on the financial statements. They answer different questions and are signed by different people.

- SOX 404(a) requires management of every issuer that files annual reports with the SEC, from its second annual report, to report on internal control. SOX 404(b) adds an auditor's attestation for accelerated and large accelerated filers only, other than emerging growth companies, which the JOBS Act of 2012 exempts, and non-accelerated filers have been exempt since September 21, 2010.

- No listing rule applies to a private company. NYSE Section 303A.07(c) requires listed companies to have internal audit, and a July 31, 2026 filing proposes a five-year window in place of the current one year.

- SOC 2 is an examination of a service organization's controls by an independent public accounting firm, issued to customers. It is not SOX and it is not internal audit.

- Outsourcing internal audit does not move responsibility from the board, and a provider that runs a process for you should not be the one to test it.

## What is the short answer, in one table?

Internal audit tests how the organization runs and reports to the board. An external audit gives an outside opinion on the financial statements. SOX 404 is a reporting rule for companies that file annual reports with the SEC, and it has two parts that people often blur together. The table puts the four side by side.

| Feature | Internal audit | External audit | SOX 404(a) | SOX 404(b) |
| --- | --- | --- | --- | --- |
| What it is | A function that tests processes, controls and risks for management and the board | An independent examination of the financial statements | Management's own assessment of internal control over financial reporting | The external auditor's attestation on that internal control |
| Who performs it | Employees, an outside provider or both | An independent public accounting firm | Company management | The registered public accounting firm that audits the statements |
| Who it reports to | The board or audit committee, with administrative reporting to management | The audit committee and the users of the statements | Investors, in the annual report | Investors, in the annual report |
| Who needs it | NYSE-listed companies; everyone else by choice or contract | SEC registrants, entities with enough federal awards, anyone a lender or investor requires it of | All issuers that file annual reports with the SEC, non-accelerated filers included | Accelerated and large accelerated filers only, other than emerging growth companies, which the JOBS Act of 2012 exempts |
| What it produces | Findings, recommendations and follow-up, with no opinion on the statements | An audit report with an opinion on the financial statements | A report of management on internal control | An attestation report on internal control |
| Standard | IIA Global Internal Audit Standards, effective January 9, 2025 | AICPA auditing standards for private companies, PCAOB standards for issuers | SEC rules, with a suitable framework such as COSO's | PCAOB standards (AS 2201) |

Sources for each cell are listed at the end of this guide and were checked on 2026-10-16.

## Who is each one for?

**Internal audit** is for the organization that wants its own processes tested and does not want to wait for the annual outside audit to find the problem. It suits a CFO who suspects the payables cycle is leaky, a board that has never seen a risk assessment, a private equity owner who wants portfolio companies tested the same way and a nonprofit board that wants to look past the audit report. For a company listed on the NYSE it is also a listing requirement: Section 303A.07(c) requires an internal audit function that gives management and the audit committee ongoing assessments of risk management and internal control.

**An external audit** is for anyone whose lender, investor, regulator or customer wants audited financial statements. It also applies to nonprofits and local entities that spend federal money. A non-federal entity that spends $1,000,000 or more in federal awards in its fiscal year must have a single or program-specific audit (2 CFR 200.501(a)). A credit agreement is a common reason a private company has an audit.

**SOX 404** is for issuers, meaning companies that file annual reports with the SEC. A private company with no SEC filings is not subject to it. A company preparing to list is, in effect, preparing for it, which is where internal audit and a documented control environment start to pay off.

## Who performs each one, and who does it report to?

The external auditor is independent of the company by rule. The AICPA's independence rules and, for SEC registrants, Rule 2-01 of Regulation S-X set what the audit firm can and cannot do for its audit client, which is why [how to choose an audit support provider](/guides/how-to-choose-audit-support-provider) starts with independence.

Internal audit is independent in a different way. It is part of the organization, and the Global Internal Audit Standards make it independent by where it sits and what it reports. The function reports functionally to the board, which the Standards say keeps it free of interference, and administratively to a member of management, with the chief executive as the leading practice. The chief audit executive confirms the function's organizational independence to the board at least once a year (Standard 7.1).

The two meet at the audit committee. The Standards expect the chief audit executive to understand how the organization coordinates activities among the board, internal and external providers of assurance services and management (Standard 9.1). In practice that means the external auditor gets the internal audit plan and the committee sees both.

A company may outsource the function, but not to the wrong firm. NYSE Section 303A.07(c) lets a listed company outsource internal audit to a third-party provider other than its independent auditor, and Rule 2-01(c)(4) of Regulation S-X generally bars an audit firm from internal audit outsourcing tied to its SEC audit client's internal accounting controls.

## What does each one produce?

**Internal audit** produces a plan the board approves, then reports with findings. A good finding states the criteria, the condition, the cause, the effect and a recommendation, and carries a management response with an owner and a date. The function then confirms that agreed actions were carried out (Standard 15.2). None of this is an opinion on the financial statements.

**An external audit** produces an audit report in which the auditor states an opinion on whether the financial statements are presented fairly in accordance with the applicable framework, which for most US companies is US GAAP. It often comes with a letter to management on control weaknesses the auditor noticed on the way.

**SOX 404(a)** produces a report of management on internal control over financial reporting, included in the annual report. The SEC's 2010 rule confirmed that all issuers, non-accelerated filers included, remain subject to it. **SOX 404(b)** produces the registered public accounting firm's attestation report on that internal control, and it applies only to accelerated and large accelerated filers, other than emerging growth companies, which the JOBS Act of 2012 exempts. Section 404(c), added by the Dodd-Frank Act, removed it for everyone else, and the SEC's rule conforming to it took effect on September 21, 2010.

## Where does SOC 2 fit?

SOC 2 is neither a SOX requirement nor an internal audit. It is an examination of controls at a service organization, such as a software company or a payroll processor, relevant to security, availability, processing integrity, confidentiality or privacy. The AICPA describes the SOC suite as services that CPAs may provide, and a SOC 2 report goes to the service organization's customers and prospects, often because a customer's procurement team asked for it.

That makes it an external report, issued by an independent public accounting firm. Internal audit can help beforehand by testing the controls the examiner will look at, and [SOC readiness bookkeeping](/services/audit-compliance-support/soc-readiness-bookkeeping) prepares the financial records that sit behind them. Neither produces the report. Finbryn does not claim a SOC 2 report of its own; the [security page](/security) lists what it can describe today.

If a customer asks for your SOC 2 status, the honest answers are a report from an examiner, a statement that an examination is planned, or a plain no. Internal audit work does not turn into any of the three.

## Which one does a private company need, and when?

Work down the list. The first line that applies tells you what is required, and anything below it is a choice.

1. **A lender or investor requires audited statements.** You need an external audit from an independent public accounting firm. Read the covenant for the deadline and the standard, and see [audit vs review vs compilation](/guides/audit-vs-review-vs-compilation) for the three assurance levels.
2. **You spend $1,000,000 or more in federal awards in a fiscal year.** You need a single or program-specific audit under 2 CFR 200.501(a). It is an external audit and your nonprofit board cannot replace it with internal work.
3. **You plan to list on the NYSE.** You will need an internal audit function in place by the first anniversary of listing, and your annual reports will carry management's SOX 404(a) report. On July 31, 2026 the NYSE filed rule change SR-NYSE-2026-37 to lengthen the one-year window to five years. The SEC published it for comment on August 18, 2026 and on September 25, 2026 extended its deadline to act to November 16, 2026 (Release No. 34-106502). Until the SEC approves it, the one-year window applies.
4. **Customers ask for security assurance.** A SOC 2 examination from an independent public accounting firm is the usual answer.
5. **None of those applies, but you want to know whether controls work.** Start with [risk and internal audit support](/services/internal-audit-risk-governance), because it is the only one of the four that is a choice.

On line 5, the ACFE's 2024 study of 1,921 fraud cases found a median loss of $120,000 where an internal audit department existed against $210,000 where it did not, a difference of 43%. Tips detected 43% of the frauds and internal audit 14%. The ACFE cautions that no control means fraud cannot occur, so treat the numbers as a reason to test.

## What does outsourcing internal audit change, and what can't it change?

Outsourcing changes who does the testing. It does not change who is responsible. The Standards define outsourcing as contracting an independent external provider, and cosourcing as outsourcing only part of the function. They apply whichever route you take, and in every case the board retains responsibility for supporting and overseeing the function. The chief audit executive, whether employed or contracted, is responsible for conformance with the Standards.

Outsourcing also brings an independence question that an in-house team does not have. Finbryn's independence policy: we do not perform internal audit work on a process we run for you, or ran for you in the previous 12 months. The engagement letter lists the processes we operate and the ones we review, and the audit committee confirms that list each year. The policy follows Standard 2.2 of the Global Internal Audit Standards, which presumes objectivity is impaired when an internal auditor provides assurance on an activity they were responsible for within the previous 12 months. Ask any provider for a written list of the processes it runs for you and the processes it reviews, and see [co-sourced internal audit](/services/internal-audit-risk-governance/co-sourced-internal-audit) for how that list is kept.

General information only. External audits and attestation reports are performed only by independent firms authorized to issue them, and Finbryn issues none. Internal audit support here is planned and reported against the IIA Global Internal Audit Standards for management and the audit committee. Conformance is the chief audit executive's to demonstrate through the function's quality program. It is not an external audit, review, compilation or attestation, and Finbryn gives no opinion on financial statements or on internal control over financial reporting under AICPA or PCAOB standards. For SOX testing support inside a firm that signs, see [SOX testing support](/services/audit-compliance-support/sox-testing-support); for getting through an audit, see [audit-ready books](/services/audit-compliance-support/audit-ready-books).

## Which four questions settle it before you hire anyone?

Most confusion comes from asking a provider to do a job that belongs to someone else. These four questions sort it out.

- **Who asked, and in writing?** A lender, a regulator, a customer or the board. The document names the thing it wants, and that word decides which of the four you need.
- **Does the document want an opinion?** If it says audit report, attestation, examination or opinion, an independent public accounting firm must issue it. Nobody else can, however good their testing.
- **Who will the work report to?** Internal audit reports to the board or audit committee. If the answer is the CFO alone, the work is closer to a finance project than to internal audit.
- **What else does the provider do for you?** Bookkeeping, payables, payroll and controller work are all processes that would sit outside the internal audit plan.

If you answer these before you start, you will spend less on the wrong engagement. [Internal audit support](/services/internal-audit-risk-governance) shows how the work is scoped once the answers are in.

External audit preparation is covered by [audit support services](/services/audit-compliance-support), which never perform or sign the audit.

## Frequently asked questions

**Q: What is the difference between internal audit and external audit?**

A: Internal audit is a function working for management and the board that tests processes and controls and reports findings; it gives no opinion on the financial statements. An external audit is performed by an independent public accounting firm and ends in an opinion on whether the statements are presented fairly. The IIA's Global Internal Audit Standards (effective January 9, 2025) govern the first, and AICPA or PCAOB standards the second.

**Q: Is SOX compliance the same as internal audit?**

A: No. SOX 404(a) requires management of an SEC filer to report on internal control over financial reporting, and 404(b) adds an auditor's attestation for accelerated and large accelerated filers only, other than emerging growth companies, which the JOBS Act of 2012 exempts (SEC rule effective September 21, 2010). SOX does not itself require an internal audit function. The NYSE listing rule, Section 303A.07(c), does for listed companies.

**Q: Does a private company need internal audit?**

A: Usually no rule says so. A lender, investor, grant or regulator may ask for it, and the NYSE requires it for listed companies within one year of listing (a July 31, 2026 filing proposes five years). The decision for a private company rests on risk and contracts. The ACFE's 2024 study found a 43% lower median loss where an internal audit department existed (checked 2026-10-16).

**Q: Does SOX apply to private companies?**

A: SOX 404 is implemented through the SEC's annual report rules, so it applies to issuers that file annual reports with the SEC. A private company with no SEC filings has no 404 obligation, though a company preparing to list builds toward it. The SEC's 2010 release confirms all issuers remain subject to 404(a) (checked 2026-10-16).

**Q: Can the same firm do my audit and my internal audit?**

A: For a listed company, no: NYSE Section 303A.07(c) lets internal audit be outsourced only to a provider other than the independent auditor. For an SEC audit client, 17 CFR 210.2-01(c)(4) generally bars internal audit outsourcing tied to internal accounting controls. For a private company, the audit firm's independence rules apply, so ask the firm in writing before you engage it (rules checked 2026-10-16).

**Q: Is a SOC 2 report an audit?**

A: It is an examination, not an audit of financial statements. A SOC 2 examination covers a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy, and CPAs perform it (AICPA SOC suite, checked 2026-10-16). It is not required by SOX, and internal audit work does not replace it.

**Q: Who does internal audit report to?**

A: To the board or audit committee for the plan, results and independence, and administratively to a member of management, with the chief executive as the leading practice. The Standards (effective January 9, 2025) say the function is most effective when directly accountable to the board, and that the chief audit executive confirms independence to the board at least annually.

## Sources

1. [The IIA, Global Internal Audit Standards (2024 edition), page opened 2026-10-16](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/) (2026-10-16)
2. [The IIA, Global Internal Audit Standards, full text published January 9, 2024 (Standards 2.2, 7.1, 9.1 and 15.2)](https://www.theiia.org/globalassets/site/standards/editable-versions/globalinternalauditstandards_2024january9_editable.pdf) (2026-10-16)
3. [SEC, Internal Control Over Financial Reporting in Exchange Act Periodic Reports of Non-Accelerated Filers, Release 33-9142 (effective September 21, 2010)](https://www.sec.gov/files/rules/final/2010/33-9142.pdf) (2026-10-16)
4. [NYSE, SR-NYSE-2026-37 filing of July 31, 2026 amending Sections 303A.00 and 303A.07](https://www.nyse.com/publicdocs/nyse/markets/nyse/rule-filings/filings/2026/SR-NYSE-2026-37.pdf) (2026-10-16)
5. [2 CFR 200.501, Audit requirements (eCFR)](https://www.ecfr.gov/current/title-2/section-200.501) (2026-10-16)
6. [17 CFR 210.2-01, Qualifications of accountants (eCFR)](https://www.ecfr.gov/current/title-17/section-210.2-01) (2026-10-16)
7. [AICPA, System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) (2026-10-16)
8. [ACFE, Occupational Fraud 2024: A Report to the Nations](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2024/2024-report-to-the-nations.pdf) (2026-10-16)
9. [Federal Register, NYSE notice of designation of a longer period for SR-NYSE-2026-37 (September 30, 2026)](https://www.federalregister.gov/documents/2026/09/30/2026-19953/self-regulatory-organizations-new-york-stock-exchange-llc-notice-of-designation-of-a-longer-period) (2026-10-16)
10. [15 U.S.C. 7262, Management assessment of internal controls (Cornell LII)](https://www.law.cornell.edu/uscode/text/15/7262) (2026-10-16)

Reviewed October 2026

[All services in Outsourced internal audit, enterprise risk and governance support](https://finbryn.com/us/services/internal-audit-risk-governance)

## Contact
- Phone: +1 (312) 313-7376
- Email: hello@finbryn.com
- Booking page: https://finbryn.com/us/book