Why internal audit still falls short—and what can be done to improve it?

Between 2005 and 2023, the Public Expenditure and Financial Accountability (PEFA) program has completed over 500 national and subnational assessments, providing an overview of how countries manage public finances. However, internal audit was frequently overlooked. The findings are indeed concerning. A staggering 86% of these assessments showed that internal audit departments operate at a basic or substandard level. A mere 2% achieved an “A” score, indicating their compliance with international best practices. This isn’t just a statistic; it reflects an ongoing challenge concerning transparency, accountability, and how effective governments are at managing taxpayer funds. 

What does "Basic" Performance mean?

In PEFA terms, “basic’ performance refers to internal audit functions that are not independent, do not adhere to professional standards, and operate without a clear plan. In many jurisdictions, these functions focus primarily on compliance rather than on performance, risk, or value for money. Even when issues are flagged in internal audit reports, they frequently remain unaddressed. There’s often no follow-up or corrective action taken, which is a missed opportunity and can result in significant costs for governments.

Observed regional patterns

While no region is immune to weak internal audit systems, certain trends stand out.

Africa, for example, had the highest number of assessments showing basic internal audit, with 196 cases. Many countries in the region are still developing their internal control systems, and consequently, internal audit often lacks adequate attention or resources. Having said that there has been positive development. In East and Central Asia, we observed some encouraging progress with eight assessments achieving an “A” rating. Although modest, it shows that with appropriate reforms, strong leadership, and sufficient investment, improvement is possible. 

Source: PEFA (2025)

Why is this important?

Internal audit goes beyond ticking boxes. It ensures proper use of public funds, manages risks, improves systems, and builds trust. Effective internal audit instills confidence in finance ministries, citizens, and development partners. Weak internal audit systems don’t just pose a technical issue but also raise fundamental concerns about trust and integrity in public institutions.

So what are the barriers holding us back?

Based on our research and discussions with counterparts and partners, we noticed there four key issues:

• Lack of independence: Auditors should not report to the same people they audit; it compromises effectiveness.
• Limited capacity: Many internal audit staff haven’t been trained in risk-based or performance auditing. Some don’t adhere to basic standards such as those set by the Institute of Internal Auditors (IIA) Standards or The International Organization of Supreme Audit Institutions (INTOSAI) Framework of Professional Pronouncements the (ISSAIs).
• Lack of political commitment from leadership: Too often, internal audit is perceived as a box-checking exercise rather than an opportunity for learning and improvement.
• Poor follow-up: Even when audits identify significant issues, if there’s no system in place to address them, their purpose becomes unclear.

What can we and should do?

The World Bank and other development partners are stepping up to support countries in improving internal audit, and I’m proud to be part of this effort.  But we need a shift in mindset—from compliance to value-adding oversight. Here’s how we can achieve that:

• Legislative and institutional reforms: Ensure that internal audit has the independence it needs, backed by law.
• Capacity development: It is essential to invest in people through training, certification, and peer learning, as these practices are crucial for growth.
• Adoption of standards: International frameworks like the IIAs and ISSAIs provide a solid foundation.
• Digitization: Modern audit tools and data analytics tools can assist audit teams in improving efficiency  and focusing on key areas.
• Internal audit and external oversight: Internal audit shouldn’t operate in isolation. Collaborating with external auditors, anticorruption agencies, and legislative bodies can facilitate the translation of reports into actionable outcomes.

Final thoughts

The PEFA findings highlight that internal audit remains underprioritized despite years of PFM reforms. That needs to change. 

Effective internal audit is a cornerstone of strong governance and, countries that get this right are the ones that treat it as a long term investment.

At the World Bank, we’re supporting countries through diagnostics, policy dialogue, technical assistance, and financing. But ultimately, real change requires national leadership and commitment to robust internal audits

It’s time to elevate these standards. We can’t afford not to.