External audit provides an independent opinion on whether a fund’s financial statements are free from material misstatement: it is a statutory reporting function directed at investors and regulators. Internal audit provides ongoing independent assurance over governance, risk management and internal controls: it is an independent assurance function supporting the board and senior management, designed to identify weaknesses and improve how the entity operates.
How Do Their Purpose and Audiences Differ?
External audit is backward-looking: it examines historical financial statements to form an audit opinion, typically once a year. For Cayman Islands funds, external audit is required under the Mutual Funds Act and the Private Funds Act, and the auditor must be a CIMA-approved auditor. Specifically, it must be a Cayman Islands-based firm on CIMA’s list of approved auditors.
Internal audit, by contrast, is forward-looking and continuous. It identifies weaknesses in controls and processes before they result in errors or regulatory breaches, and its audience is the board and senior management rather than investors or regulators.
What is the Scope of Internal and External Audit Roles?
External auditors focus on financial reporting, whether the accounts are presented fairly and in accordance with applicable accounting standards, primarily US GAAP or IFRS for Cayman funds, though GAAP of Japan, Switzerland, and other non-high-risk jurisdictions is also permitted.
Internal auditors address a much broader range of risk areas: operational processes, governance structures, AML/KYC compliance, IT controls, oversight of delegated functions, and the adequacy of policies and procedures. The two functions do not duplicate each other; they provide different types of assurance across different domains.
What are the Reporting Lines for External and Internal Audits?
Both external and internal audit must be independent of management, but they achieve this differently.
External auditors are appointed by shareholders or the board and issue their opinion publicly as part of the audited financial statements. Internal auditors, whether in-house or outsourced, report directly to the board or audit committee, with findings kept within the governance structure rather than disclosed publicly.
How do the Two Functions Interact?
A well-governed Cayman fund will have both external and internal audit in place. External auditors may, where appropriate, place reliance on internal audit work when assessing controls, which can reduce the scope and cost of external audit procedures. Sharing internal audit reports with external auditors on a structured basis can strengthen the overall assurance framework and signal a mature governance culture.
Managing both external and internal audit requirements effectively requires clear governance structures, defined reporting lines, and an understanding of how each function supports the other.
Related questions: What is an internal audit function and is one required for a Cayman Islands regulated entity? | What are the key components of a risk-based internal audit programme for an offshore investment manager?
At wb.group, we provide internal audit services for Cayman Islands regulated entities. Contact us to discuss how we can support your governance framework.
FAQs
External audit provides an independent opinion on whether a fund’s financial statements are free from material misstatement: it is a statutory reporting function directed at investors and regulators. Internal audit provides ongoing independent assurance over governance, risk management and internal controls: it is an independent assurance function supporting the board and senior management, designed to identify weaknesses and improve how the entity operates.
Yes, for registered and licensed funds. Under the Mutual Funds Act and the Private Funds Act, Cayman Islands funds are required to have their financial statements audited annually by a CIMA-approved auditor. This is a statutory requirement, not a discretionary governance decision, and failure to comply may result in regulatory breaches, penalties, or enforcement action by CIMA.
Not in depth. External audit focuses on whether financial statements are free from material misstatement. Auditors assess internal controls only to the extent that they affect financial reporting risk. A separate internal audit function is required to evaluate the broader governance, operational, and compliance control environment.
In most cases, Cayman Islands regulated entities should avoid appointing the same firm to perform both external and internal audit functions because doing so may impair auditor independence or create conflicts under applicable professional standards. Where an entity outsources its internal audit function, the provider must be a different firm from its appointed external auditor.