Internal audit function (IAF)
The independent function within an organisation that assesses the design and operation of the internal risk management and control systems and gives the management board and supervisory board assurance and advice on them. In the Dutch Corporate Governance Code the function is covered by principle 1.3; the professional standards are the IIA's Global Internal Audit Standards.
Source: Nederlandse Corporate Governance Code 2025, principe 1.3; IIA Global Internal Audit Standards 2024; Internal Audit Monitor 2025
An internal audit function (IAF) gives the management board and supervisory board independent insight into how well the organisation manages its risks. Under principle 1.3 of the Dutch Corporate Governance Code, the function's task is to assess the design and operation of the internal risk management and control systems. The management board is responsible for the function and the supervisory board oversees it. Provisions 1.3.1 to 1.3.6 cover, among other things, the appointment and dismissal of the senior internal auditor, the work plan, reporting to the management board and audit committee, and an assessment by an independent third party at least once every five years.
An IAF can take different forms. Most listed companies have an in-house function with a Chief Audit Executive on the payroll. Other forms are co-sourcing, where an in-house head of internal audit is supplemented with external specialists, full outsourcing, a combination with risk management under one person, and a function with a limited scope. If a listed company has no internal audit department, best practice provision 1.3.6 has the supervisory board assess each year whether adequate alternative measures have been taken and whether an in-house department is needed.
The Internal Audit Monitor has tracked the function at Dutch listed companies since 2016. According to the 2025 edition, around 72% of listed companies based in the Netherlands had an IAF in 2024: 58 of 81, against 52% in 2016. Every AEX company has one; the strongest growth was among the smaller AScX companies, from 39% to 68%. Full outsourcing remained an exception.
Outside the stock exchange, the law requires an audit function by sector, for example at banks, insurers and pension funds. For other organisations an IAF is a choice for the board and supervisors.
ONE Risk Advisory conducts the Internal Audit Monitor in collaboration with IIA Netherlands and Nyenrode Business University, and helps organisations set up, strengthen and have their internal audit function assessed.
Last updated:
Related service Internal Audit
Frequently asked questions
Is an internal audit function mandatory for listed companies?
Not by law. The Corporate Governance Code takes an in-house internal audit department as the starting point, but works on a comply-or-explain basis: without one, the supervisory board assesses each year whether adequate alternative measures have been taken (best practice provision 1.3.6). The explanatory notes describe outsourcing as an adequate alternative if the size of the company does not lend itself to an in-house department. Banks, insurers and pension funds do have a statutory obligation.
How many listed companies have an internal audit function?
According to the Internal Audit Monitor 2025, around 72% of listed companies based in the Netherlands had an internal audit function in 2024, 58 of 81. In 2016 this was 52%.
What is the difference between the internal audit function and the external auditor?
The external auditor audits the financial statements and reports on them to shareholders and the outside world. The internal audit function works for the management board and supervisory board and assesses more broadly how the organisation manages its strategic, operational, compliance and reporting risks.