Internal Audit in Thailand.

Internal audit in Thailand: assurance for management, not for the law

Internal audit in Thailand is work a company commissions for itself. An auditor examines how the business actually runs, whether its controls hold, where money or stock could leak, and reports to the owners or the board.

That makes it different from the statutory audit, the annual audit of the financial statements that Thai law requires of companies. The statutory auditor answers to the law and gives an opinion on the accounts. An internal auditor answers to management and tells you what to fix.

No rule forces a private Thai company to have an internal audit function. Companies pay for one anyway when the cost of not knowing gets too high.

What an internal audit reviews

Three kinds of review make up most engagements. A controls review tests whether the safeguards around cash, payments, approvals, and inventory work in practice, not just on paper. A process review walks through how work actually flows, purchasing to payment, order to cash, and finds the steps where errors or delays start. A fraud-risk review looks for the gaps someone could exploit: one person holding a payment end to end, supplier records nobody reconciles, manual overrides nobody logs.

The output is a report for management: findings ranked by risk, and specific fixes. Good controls also make the rest of the compliance year cheaper, because the statutory filings the finance team answers to, like the annual tax return due within 150 days of the accounting period's close, are built on numbers that were controlled all year.

Checking whether specific past obligations were actually met, filing by filing, is a different engagement: that is a compliance audit.

Outsourced internal audit for SMEs

Most SMEs in Thailand are too small to employ an internal auditor, so the function is bought in. Accounting firms in Thailand and specialist audit firms offer internal audit as a recurring engagement, quarterly or annual, or as a one-off review when something specific worries the owner: a suspected leak, a new manager taking over the books, a parent company asking for controls assurance.

One boundary matters when you hire: the firm that signs your statutory audit should not also be designing and reviewing your controls as if it were management. Firms handle this by separating teams or by the company using different firms for the two roles; ask how the firm you shortlist does it. If the whole finance back office is the real gap rather than the controls around it, outsourced accounting is the engagement to compare first.

Firms scope and quote internal audit case by case, so compare what the fieldwork covers rather than the headline fee.

This page is general information, not legal advice. Rules and requirements change; for a specific company, speak with a qualified professional.