Aug 27

2026

What to expect from your first internal audit if you run a grant-funded or not-for-profit organisation

A first internal audit is designed to assess whether your organisation’s controls, governance and processes are working as intended. For a grant-funded or not-for-profit organisation, the scope may include procurement, grant expenditure, payroll, restricted funds, delegated authority and evidence supporting funder claims.

Internal audit is different from statutory external audit. An external auditor expresses an opinion on the financial statements, while internal audit focuses on risk, controls and opportunities for improvement. Our guides to what an external audit expects to see and how forensic accounting differs from audit explain those distinctions.

What the internal audit process usually involves

There is no fixed statutory timetable for an internal audit. The timing and scope depend on the organisation, risks, funder requirements and agreed terms of reference.

Professional internal audit work in the UK is guided by the Global Internal Audit Standards, which became effective in January 2025. The Chartered Institute of Internal Auditors provides professional guidance for UK practitioners.

Internal audit is not determined by charity audit thresholds

Internal audit is normally driven by governance needs, funder conditions, contractual requirements or a board’s assessment of risk rather than charity-law income thresholds.

External scrutiny rules vary by jurisdiction. In England and Wales, the current charity audit threshold is generally income above £1 million, or income above £250,000 where gross assets exceed £3.26 million. These thresholds are due to increase for accounting years ending on or after 30 September 2026.

In Scotland, charities must have external scrutiny, with the audit threshold generally increasing to £1 million for accounting periods beginning on or after 1 January 2026, subject to asset and legal-form considerations.

Northern Irish organisations should check current requirements with the Charity Commission for Northern Ireland, while organisations in the Republic of Ireland should refer to the Charities Regulator. Irish requirements also depend on whether the organisation is incorporated and on the commencement of relevant provisions of the Charities (Amendment) Act 2024.

Common issues internal auditors identify

Grant-funded organisations frequently need clear evidence supporting procurement, staff costs and restricted expenditure. Typical areas for review include:

• Missing quotations or procurement documentation
• Staff costs allocated without adequate supporting records
• Unclear overhead allocations between restricted funds
• Expenditure falling outside a grant’s eligible period
• The same person preparing and approving transactions
• Weak monitoring of restricted reserves

Our guide to strengthening internal controls against financial fraud explains segregation of duties, while reliable monthly management accounts can highlight funding and cash-flow issues earlier. The red flags that appear in smaller organisations are also useful for trustees and boards.

How to prepare

Gather your grant agreements, finance policies, delegated authority schedules, funder reporting requirements and recent management information. Make sure transaction evidence is accessible and explain to staff that internal audit is an assurance exercise, not automatically an investigation.

Organisations with scattered records may also benefit from moving to cloud accounting. SCC’s internal audit team can tailor the scope to the organisation’s risks and funder requirements.

Frequently asked questions

Do we need internal audit if we already have an external auditor?

Not necessarily, but the two serve different purposes. A funder, board or public-sector contract may require additional assurance. See our guide to SME action plans for public sector contracts.

How much does an internal audit cost?

There is no standard fee. Cost depends on scope, organisation size, locations, systems and the amount of testing required. The SME and organisational support team can help define an appropriate scope.

What if the audit identifies a serious problem?

Significant losses or suspected wrongdoing may require support from the forensic accounting team. Where funding issues create financial pressure, SCC’s recovery and restructuring specialists can also assist.

If a funder or board has requested assurance work, talk to SCC Chartered Accountants about defining a proportionate first internal audit.