The Relationship Between Internal Audit and In-House Legal

The past week marked the release of the DSE results, a moment that reflects years of preparation. As expected, top scorers across Hong Kong received wide media attention. What stood out this year is that all of the top students chose only two top local universities for medical school. Compared to ten or twenty years ago, the range of choices among Hong Kong’s brightest students has narrowed significantly. In the past, we had rankings for prestigious programs beyond medicine, such as law, actuarial science, civil engineering, accounting and computer science. These disciplines shaped professional elites who pursued rigorous exams and certifications to become future leaders of society.

However, with the rise of artificial intelligence and the mass expansion of higher education, the path of professional development may no longer be as straightforward as it once seemed. The younger generation appears to have a clearer view of future trends and is making choices that reflect current societal and economic shifts. What was once considered a stable path is now being re-evaluated in real time.



Two Guardians, One Mission

Both the Internal Audit and Legal departments serve as guardians of the organization. Legal focuses on ensuring compliance with laws, managing contracts, advising on legal risks, and handling litigation. Internal Audit, meanwhile, is responsible for assessing internal controls, evaluating governance frameworks, and identifying operational and strategic risks. Though their mandates differ, their overarching objective is the same: to protect the organization.

In practice, however, their working relationship can be both collaborative and challenging. They frequently encounter overlapping responsibilities, especially in areas such as fraud investigations, whistleblower management, regulatory reviews, and reputational risk. If the two departments operate in silos or fail to coordinate, there may be inefficiencies, blind spots, or even conflicting actions.

Where Collaboration Matters Most

There are several common situations where Internal Audit and Legal must work hand in hand.

In fraud investigations, Internal Audit may be the first to detect suspicious activity and collect evidence, while Legal is needed to assess legal exposure, protect attorney-client privilege, or manage disciplinary actions. In whistleblower cases, Internal Audit conducts fact-finding, while Legal ensures the company’s response complies with applicable laws and whistleblower protections.

During regulatory inspections or compliance audits, Legal advises on statutory interpretations and represents the company’s legal position, while Internal Audit provides documentation, risk assessments, and evidence of control effectiveness. When it comes to contract execution, Legal ensures that agreements are sound, while Internal Audit may later evaluate whether terms are being followed and whether any operational risks have emerged in delivery.

Different Perspectives, One Objective

Despite their shared goal of protecting the organization, Internal Audit and Legal often approach issues from different angles. Legal teams are typically concerned with legal exposure, precedent, and formal obligations. Internal Auditors, on the other hand, focus on control effectiveness, risk mitigation, and operational efficiency.

This difference in orientation can sometimes cause tension. For example, an Internal Auditor might recommend adding more checkpoints or reviews to a procurement process to prevent fraud, whereas the Legal team might view the change as unnecessary from a regulatory standpoint.  These differences are not wrong; they reflect the professional lenses through which each department operates.

To bridge the gap, mutual respect and early engagement are essential. The most forward-thinking organizations ensure that both Legal and Internal Audit are involved at the start of key investigations, major projects, or policy changes. Some companies even hold joint risk committees or regular check-ins where both departments share insights, align expectations, and coordinate responses to emerging risks.

Redefining Professional Excellence

Just as students today are rethinking what a traditional career path should look like, professional departments must also evolve. The future of corporate governance lies in breaking down silos and building cross-functional alliances. Expertise is important, but it is no longer enough. The ability to communicate across disciplines, to collaborate strategically, and to jointly solve complex problems is what distinguishes the professionals of tomorrow.

The partnership between Internal Audit and In-House Legal represents this shift. When they operate not as parallel units but as complementary forces, they can detect risks earlier, respond more effectively to incidents, and advise management with greater depth and foresight. Together, they form a trusted internal advisory team that helps steer the company through uncertainty.

In this new era, being professional is no longer just about technical mastery. It is about agility, cooperation, and shared accountability. And in that sense, the Internal Auditor and the In-House Counsel have more in common than ever before.

Comments