In less than ten years, the internal audit function (IAF) has grown into a fixed pillar of good governance at Dutch listed companies. The share of listed companies with an IAF rose from 52% in 2016 to around 72% in 2024. This emerges from the Internal Audit Monitor 2025, the periodic study by ONE Risk Advisory and Nyenrode Business University, in collaboration with IIA Netherlands. This edition examines not only the presence and design of the IAF, but also its role in the new Risk Management Statement (Verklaring omtrent Risicobeheersing, VOR).
How many listed companies have an internal audit function?
Almost three quarters of the listed companies based in the Netherlands had an internal audit function in 2024. In absolute terms this grew from 50 functions in 2016 to 58 in 2024, while the total number of Dutch listed companies fell from 96 to 81 over the same period.
Behind that average lie clear differences by stock index. AEX and AMX companies have an internal audit function almost without exception, a stable and consistent picture. The strongest relative growth is among the smaller companies: in the AScX the share rose from 39% in 2016 to 68% in 2024.
By year and by stock index, the development looks as follows.
| Year | With an IAF | Total | Share |
|---|---|---|---|
| 2016 | 50 | 96 | 52% |
| 2017 | 58 | 97 | 60% |
| 2018 | 61 | 97 | 63% |
| 2019 | 61 | 94 | 65% |
| 2020 | 62 | 95 | 65% |
| 2021 | 62 | 91 | 68% |
| 2022 | 60 | 90 | 67% |
| 2023 | 59 | 86 | 69% |
| 2024 | 58 | 81 | 72% |
| Stock index | 2016 | 2024 |
|---|---|---|
| AEX | 21 of 21 (100%) | 21 of 21 (100%) |
| AMX | 17 of 22 (77%) | 17 of 18 (94%) |
| AScX | 9 of 23 (39%) | 15 of 22 (68%) |
| Local companies | 3 of 30 (10%) | 5 of 20 (25%) |
| Total | 50 of 96 (52%) | 58 of 81 (72%) |
Of the 58 functions in 2024, 48 were in-house, 6 fully outsourced and 4 combined with risk management.
An important nuance is the increased transparency in annual reports. Companies that previously reported an IAF now more often state explicitly when audit work is placed with other functions and therefore does not meet the characteristics of a full function. From 2021 onwards it is therefore more accurate to speak of stabilisation than of decline. In practice we see that boards and supervisory directors do not regard the IAF as a mere statutory obligation, but as a partner in business that contributes to effective internal control.
Size doesn’t matter: smaller companies set up an IAF too
The most frequently cited reason for not having an internal audit function is the limited size of the organisation. The figures contradict this: it is precisely the smaller AScX companies that showed the strongest growth. The assumption that only large organisations can afford an effective audit function is therefore outdated.
Full outsourcing of the internal audit function remains an exception and ranged between four and eight companies over the period 2016 to 2024. The majority deliberately opt for an in-house function, which underlines the importance that boards and supervisory directors attach to a structurally embedded, independent third line. In practice we more often see co-sourcing: a dedicated Chief Audit Executive (CAE) within the organisation, supplemented with external expertise and capacity on a flexible basis. A proportionate IAF is feasible in several ways:
- a phased build-up, step by step towards a full function;
- a compact core team, supplemented with co-sourcing;
- or, for the smallest companies, full outsourcing.
Transparency is increasing: five good practices
Listed companies explain the design and operation of their internal audit function in ever greater detail. By now, with one exception, no company leaves the absence of an IAF unexplained, which confirms how the comply-or-explain principle works. The analysis of annual reports reveals five good practices:
- a clear positioning within the three lines model, including the division of responsibilities with the first and second line;
- clear reporting lines, with the IAF reporting functionally to the audit committee and administratively to the board;
- transparency about scope and approach, with concrete audit topics and the prioritisation by risk, including strategic and ESG-related risks;
- application of the International Professional Practices Framework (IPPF) of the IIA;
- reporting on an External Quality Assessment and its outcome; since the 2022 Code, best practice provision 1.3.2 asks for an assessment by an independent third party at least once every five years.
What changes with the Risk Management Statement (VOR)?
The most important innovation in the Dutch Corporate Governance Code, updated in 2025, is the Risk Management Statement (VOR) in best practice provision 1.4.3. The Code applies to financial years from 1 January 2025 and, as always, works on a comply-or-explain basis. With the VOR the board accounts for the design, operation and effectiveness of the internal risk management and control systems. Among other things, it states that these systems provide a reasonable degree of certainty that the financial reporting is free of material misstatement, at least a limited degree of certainty that the sustainability reporting is free of material misstatement, and what degree of certainty they provide that operational and compliance risks are managed effectively. The statement also covers shortcomings in the systems, the going concern assumption and the material risks and uncertainties for the next twelve months.
According to the Practice Guide on the VOR and the internal audit function published by IIA Netherlands (November 2024), the internal audit function has no executive responsibility here. From its independent position it can contribute, however, for example with audits of specific risk areas, audits of the risk management process, an assessment of the quality of the second line, advice on the substantiation and implementation, and a review of the draft VOR.
What role does internal audit play in the VOR in practice?
For the Internal Audit Monitor 2025, a survey was conducted among heads of internal audit functions in August and September 2025. Of the 34 functions included in the analysis, 85% report being involved in the VOR. The contribution usually aligns with existing audit work: audits that provide input for the statement. The table below shows the reported contributions.
| Contribution of the internal audit function to the VOR | % of respondents |
|---|---|
| Audits of the control of specific risk areas | 68% |
| Audits of the risk management process | 65% |
| Audits of the quality of second-line functions | 62% |
| Review of the draft VOR | 44% |
| Advice on substantiation or implementation of the VOR | 44% |
| Formal assurance on (parts of) the VOR | 21% |
| No contribution or not involved | 15% |
Formal assurance on the VOR or parts of it currently occurs at around one in five functions (21%). This is understandable: definitions, frameworks and evidence are still developing in many organisations, particularly for operational and compliance risks. For most respondents the VOR has not led to materially different work; no respondent reports a fundamental change to the audit work. The two biggest challenges that the heads of IAF cite are interpreting concepts such as assurance and effectiveness, and gathering sufficient and suitable evidence to substantiate the statement on a sound basis.
What does this mean for your organisation?
Three pieces of advice emerge from the study. Invest in in-house audit capacity, because the dominance of internal functions confirms the perceived added value of in-house expertise. Use outsourcing and co-sourcing strategically, particularly for smaller companies or scarce, specialist knowledge. And be transparent about the choices made and the safeguards for good governance under an alternative model.
For the VOR: treat the statement not solely as a formal reporting obligation, but as an opportunity to demonstrably strengthen risk management and internal control. By involving the internal audit function early and deliberately, the quality of the statement improves and a consistent, well-substantiated story emerges for stakeholders.
About the Internal Audit Monitor
The Internal Audit Monitor appears periodically. Earlier editions are the Internal Audit Monitor 2017, describing the situation in 2016, and the Internal Audit Monitor 2021, published in 2022, covering 2016 to 2020. In between, a study covering 2016 to 2018 appeared in the Maandblad voor Accountancy en Bedrijfseconomie in 2020. ONE Risk Advisory conducts the study in collaboration with IIA Netherlands and Nyenrode Business University. The 2025 edition was written by Robert Bogtstra and Inge Garretsen (ONE Risk Advisory) and Remko Renes (Nyenrode Business University). The study is based on two sources: an analysis of public annual reports over the period 2016 to 2024, and a survey among heads of internal audit functions, conducted in August and September 2025.
Would you like to know what an internal audit function can mean for your organisation, or how co-sourcing, an external quality assessment or the substantiation of your VOR would work in your situation? Please get in touch with us.