Internal Audit in Switzerland: Definition, Tasks & Goals Explained

Internal audit is one of the most effective tools a company has for staying in control of its own operations. By independently reviewing processes, risks, and controls from within, it gives management a clear, unfiltered view of what is working, and what isn’t.

This article explains what internal audit is, how it differs from the statutory external audit required under Swiss law, what the legal obligations are for Swiss companies, and how SMEs can put internal audit to practical use.

Internal audit is an independent function within an organisation that assesses the effectiveness of risk management, internal controls, and governance processes. Its purpose is to help the organisation achieve its objectives by identifying weaknesses and recommending improvements before they become costly problems.

This is fundamentally different from the external statutory audit (Revisionsstelle), which is performed by a licensed third-party auditor and focused primarily on whether the financial statements comply with Swiss law. The external auditor reports to shareholders; internal audit reports to management and the board.

The Institute of Internal Auditors (IIA), which globally represents more than 260,000 members and has awarded over 200,000 Certified Internal Auditor (CIA) certifications, defines internal auditing as an "independent, objective assurance and advisory service designed to add value and improve an organisation's operations," In practice, this means helping the organisation accomplish its objectives by systematically evaluating its governance, risk management, and control processes.

IIA Switzerland (SVIR) represents the profession locally, with around 3,000 members and over 160 leading companies, and mandates adherence to international standards for all its members.A practical way to draw the distinction: external audit asks whether the numbers are right. Internal audit asks whether the processes are right, and what risks the organisation is not yet seeing.

For a full overview of how the statutory audit works in Switzerland, see our dedicated guide.

Internal audit covers four main areas: risk management, internal controls, compliance, and operational performance.

In practice, this means reviewing whether risk identification processes are working and whether the organisation actually responds to the risks it identifies. It means testing whether financial controls are preventing errors and fraud.

It also means checking whether the company is meeting its legal and regulatory obligations under Swiss law. And finally, evaluating whether processes are operating efficiently, or whether there are gaps costing the business time and money.

Internal audit activities are commonly categorised as: financial auditing (finances and accounting), operational auditing (personnel, IT, and core processes), management auditing (oversight of executive management), and compliance auditing (adherence to laws and regulations).

The IIA's Global Internal Audit Standards (released in January 2024 and effective from 9 January 2025) organise the profession around 15 guiding principles across five domains. These replace the former framework (the 2017 IPPF) and represent the current benchmark for internal audit practice in Switzerland and internationally.

Since their release, the standards have been translated into 25 languages and downloaded nearly 600,000 times, according to the IIA; a clear sign of the profession's global reach and the standards' practical importance.

The principles most relevant to day-to-day internal audit practice are:

• Independence and objectivity: Auditors must remain free from management influence over their findings
• Integrity: The function must be conducted with honesty and professional discipline
• Competence: Auditors must have the knowledge and skills to assess what they review
• Risk-based approach: Audit activity should be prioritised by risk severity, not routine or tradition
• Effective communication: Findings must be reported clearly and lead to action

IIA Switzerland mandates conformance with these standards for all its members.

Internal audit follows a four-phase cycle, whether applied as a one-off engagement or as part of an annual audit plan.

1. Planning: The auditor defines scope and objectives, conducts a preliminary risk assessment, and agrees on the approach with management. Effective planning ensures effort is concentrated where risk is highest.
2. Fieldwork: Evidence is gathered through document review, interviews, data analysis, and control testing. This is where control weaknesses and operational gaps are identified and verified. Modern audit practice increasingly uses data analytics to review entire transaction populations rather than relying on sampling alone, leading to more reliable findings.
3. Reporting: Findings are documented in an audit report with clear recommendations for corrective action. Management responds by agreeing with findings, proposing remediation steps, and committing to timelines.
4. Follow-up: The auditor revisits agreed actions to verify they have been implemented. Without follow-up, audit reports generate recommendations that are filed and rarely acted on.

A professional audit engagement typically includes an entrance meeting with management before fieldwork begins and an exit meeting to align on findings before the final report is issued. This keeps management informed throughout and reduces the risk of surprises.