The correct answer is: The external auditor is required to be independent of the entity; the internal auditor works for and reports to the management of the entity.

The fact that the external auditor provides an independent opinion is central to an external audit. Internal auditors are not independent of the business. They are required to give an objective opinion, but they are very much still a part of the business they are reporting on.

An internal audit department is always set up as a result of management decision, although this may be prompted by codes of best practice, for example, the Corporate Governance Code requires companies with a premium listing in the UK to evaluate the need for an internal audit department annually. However, this is not the most important distinction between external and internal audit, as the management of a company may sometimes choose to have an external audit even where statute does not require that they do so.

Although there is no statutory requirement for internal auditors to hold certain qualifications, as there is for external auditors, internal auditors may still be highly qualified.