Internal Audit Monitor 2021: growth of the internal audit function and combining it with risk management

The Internal Audit Monitor 2021 follows the internal audit function (IAF) at Dutch listed companies over the financial years 2016 to 2020. Robert Bogtstra and Inge Garretsen (ONE Risk Advisory) and Remko Renes (Nyenrode Business University) wrote the report at the request of IIA Netherlands; it was published in 2022. Besides developments in numbers and forms, this edition looks at the quality of explanations when an IAF is absent, and at a subject that is much debated in practice: combining internal audit and risk management in one function.

From 52% to 67% in four years

The share of Dutch listed companies with an internal audit function rose from 52% at the end of 2016 to 67% at the end of 2020. Growth was already visible from 2010 to 2016, but was strongest from 2016 to 2017. The researchers link this to the revised Corporate Governance Code of 2016, which paid a great deal of attention to internal audit. After that, the increase levelled off.

All AEX companies and almost all AMX companies had an IAF at the end of 2020. In the AScX the share rose from 39% to 68%, among local companies from 10% to 21%. In 2020 three new internal audit functions were added, two of them at newcomers to Euronext Amsterdam that already had one. Two companies announced that they would set up or re-establish an IAF in 2021.

Explaining why there is no IAF

The Code works on a comply-or-explain basis. A company that departs from a principle or best practice provision explains how and why, whether the departure is temporary and when it intends to comply again, and which alternative measure it has taken and how that achieves the purpose of the provision. For the IAF, best practice provision 1.3.6 is the anchor: without an internal audit department, the supervisory board assesses each year whether adequate alternative measures have been taken and whether an in-house department is needed. The explanatory notes to the Code take an in-house department as the starting point and describe outsourcing as an adequate alternative if the size of the company does not lend itself to one. Limited size alone is therefore not yet a reasoned explanation.

In practice, explanations often fell short. The authors’ earlier study of financial year 2018, published in 2020 in the Maandblad voor Accountancy en Bedrijfseconomie, found only three listed companies whose explanation met the criteria of the Code. The Monitor 2021 finds that quality has hardly improved since. Most companies without an IAF simply stated that the organisation is of limited size, without saying whether that refers to revenue, number of employees, locations, geographical spread or something else. Two companies gave no explanation at all for 2020.

The Monitoring Committee Corporate Governance Code likewise emphasised the quality of reporting in its report on financial year 2020 (December 2021): compliance is not a box-ticking exercise, and boilerplate texts fit poorly with it. A good explanation therefore describes not only which alternative measures are in place, but also why they suffice for the purpose of the provision and how they contribute to good corporate governance. The picture has since improved: according to the Internal Audit Monitor 2025, with one exception no listed company still leaves the absence of an IAF unexplained.

Combining internal audit and risk management: no taboo, but conditions apply

Combining internal audit and risk management is often seen as undesirable. In the three lines model, risk management is a second-line function and internal audit the independent third line. Merging the two touches on the independence and objectivity of the audit function.

In their annual reports for 2020, five Dutch listed companies reported that risk management and internal audit fall under one responsible person. They stressed that responsibility for risk management lies with the first line and that the risk management work of the audit function is supportive. What that work comprises exactly, and why a combination was chosen, was not always clear from the annual reports.

Practice shows more combinations than the annual reports do. In external quality assessments the researchers more often saw functions combining internal audit with enterprise risk management or with specific control teams, and many audit functions carry out risk management activities to a greater or lesser extent, such as facilitating risk assessments and workshops. This is most common in smaller organisations and in organisations with a still immature second line, but also in organisations that are well advanced in their internal control. The researchers saw two forms: the same people do audit work and coordinating or facilitating risk management work, or separate sub-teams work under one head, with the risk management team also giving advice.

According to the report, the case for a combination is that both functions exist for the management board and the supervisory board and that their work is closely related. Directors increasingly want one integrated picture of internal control, in one language and with one point of contact, and for smaller organisations one head brings efficiency: less coordination, less overlap and fewer gaps. On the other hand, the independence of the third line must remain safeguarded. Internal audit cannot provide independent assurance on activities for which it is or was responsible itself, and it takes no responsibility for controls or risk appetite. If the board wants assurance on risk management, an independent third party is the obvious choice.

The report’s conclusion: combining internal audit and risk management is not a taboo from the perspective of independence and can, in some situations, fit well with directors’ need for clear insight into internal control, but it does require compensating measures. From a governance perspective, two separate functions remain the starting point; a combination can fit during a development phase or, under conditions, structurally.

Where do things stand now?

Since the report, the frameworks have become clearer. The Global Internal Audit Standards, effective since 9 January 2025, allow the Chief Audit Executive to fulfil other roles as well, provided the board acknowledges the potential impairment of independence and safeguards are agreed. In the Dutch two-tier model, the board means the management board and the supervisory board with its audit committee. For the areas under the Chief Audit Executive, assurance must be arranged in another way, for example through an objective, competent external provider that reports independently to the board. Where assurance concerns an activity for which an auditor was responsible in the preceding twelve months, the Standards presume that objectivity is impaired.

In July 2026 the IIA published two Statements of Position, on the Three Lines Model and on the role of internal audit in enterprise risk management. According to the latter, the Chief Audit Executive makes no decisions about risk responses and is not accountable for them. The former asks, where the audit function also does second-line work, for a documented division of tasks, approval of that broader remit by the board, transparency about it and assurance by another independent party on the overlapping area.

Stricter rules apply to financial institutions. At banks, under the European banking rules, the audit function is combined with no other function. At pension funds, the audit function cannot be combined with another key function. Insurers under Solvency II may combine it only under strict conditions until 29 January 2027, and no longer from 30 January 2027.

For listed companies outside the financial sector, the report’s conclusion stands. Those who combine internal audit and risk management set out the division of tasks and the safeguards in the charter, have the broader remit approved by the management board and the supervisory board, and arrange independent assurance on risk management.

How the series continued

The Internal Audit Monitor 2017 was the first edition, with the situation in 2016 as its starting point. According to the Internal Audit Monitor 2025, around 72% of listed companies based in the Netherlands had an internal audit function in 2024; that edition also examines the role of the IAF in the Risk Management Statement (VOR).

About the study

Like the earlier editions, the Internal Audit Monitor 2021 is based on public information: the annual reports for 2020 and the composition of the AEX, AMX and AScX indices and the local companies. Because of changes in that composition, such as new listings and delistings, the comparative figures for 2016 to 2019 were recalculated. Three companies had not yet published an annual report for 2020 at the time of the study and are not included. The report was published by IIA Netherlands and ONE Risk Advisory; the text may be used with acknowledgement of the source.

Download the report: Internal Audit Monitor 2021 (PDF, in Dutch)

Would you like to know how to safeguard a combination of internal audit and risk management, or which design of the internal audit function suits your organisation? Please get in touch with us.