This practical guide presents companies offering internal audit services in Scotland, rather than ranking them from first to last. The selection includes larger companies with broad audit, risk and assurance capabilities alongside more focused specialists working in particular sectors or areas of internal control. Each company brings a different mix of experience, service scope and client focus. The aim is to give useful context on who these companies are, the organisations they serve and the strengths relevant to internal audit engagements. This overview can help readers compare available options and identify companies that fit their specific assurance, governance and risk requirements.
Acumon
Acumon is a UK company of chartered accountants, auditors and advisors providing internal audit services as part of its Risk & Technology Assurance practice. The company supports organisations that need independent reviews of governance, risk management, operational processes and internal controls, including businesses that do not maintain a permanent in-house internal audit function.
Internal audit engagements can be structured as fully outsourced, co-sourced or ad-hoc assignments. A fully outsourced arrangement can cover annual audit planning, individual reviews, management action tracking and reporting to the audit committee, while co-sourcing allows Acumon specialists to work alongside an organisation’s existing internal audit team.
For organisations in Scotland, Acumon combines UK-wide service coverage with a direct Scottish presence. The company lists Aberdeen among its UK offices, and its team includes an Audit Partner and Head of Scotland. This gives Scottish organisations access to local leadership alongside the wider audit, risk and technology assurance resources of the company.
Internal audit work can extend beyond financial processes to areas such as governance, IT risk, fraud prevention, regulatory compliance and operational controls. Acumon’s wider Risk & Technology Assurance practice also addresses evolving governance requirements, including board-level expectations concerning the effectiveness of material internal controls.
The internal audit service is relevant to a range of organisational structures, including commercial businesses, charities, academy trusts and regulated organisations. Acumon notes that outsourced arrangements can be proportionate to the organisation, including focused programmes consisting of selected reviews rather than a permanent internal audit function.
Acumon works with management teams, boards and audit committees to provide independent assurance over risk and controls. Engagements can therefore be used both by Scottish organisations establishing an internal audit function and by organisations that already have internal audit resources but require additional capacity or specialist expertise.
Internal Audit Capabilities
Acumon provides internal audit services that can be adapted to an organisation’s governance structure, risk profile and existing assurance arrangements.
These include:
- Fully outsourced internal audit functions
- Co-sourced internal audit support
- Risk-based internal audit planning
- Governance and internal control reviews
- Management action tracking
- Audit committee reporting
Internal audit engagements are supported by senior professionals and can draw on specialist expertise where reviews involve areas such as technology risk, fraud, governance or financial controls.
Regulatory Licences and Registrations
Acumon’s wider audit practice holds UK and international registrations relevant to organisations operating within regulated or multi-jurisdictional structures.
These include:
- UK statutory audit registration
- Public Interest Entity (PIE) audit authorisation
- Jersey audit recognition
- Isle of Man audit recognition
- Cayman Islands audit licence
- British Virgin Islands audit licence
These registrations relate primarily to Acumon’s external audit work rather than being requirements for internal audit engagements. They nevertheless reflect the company’s wider experience of working with regulated entities and organisations whose governance and assurance requirements extend across multiple jurisdictions.
Core Services
In addition to internal audit, Acumon provides related audit, governance, risk and technology assurance services that can support organisations with broader control and compliance requirements.
These include:
- Internal audit outsourcing
- Co-sourced internal audit
- Governance and internal control reviews
- IT audit and technology assurance
- Risk management and compliance support
- Statutory external audit
- Group and subsidiary audits
Internal audit work is often connected with discussions involving management, boards and audit committees about governance arrangements, risk exposure, control effectiveness and outstanding management actions. The scope can be adjusted according to the organisation’s size, regulatory environment and existing assurance resources.
Organisations may consider additional internal audit support when operations expand, governance responsibilities become more complex or existing teams lack the capacity or specialist knowledge required for particular areas of the audit plan. Co-sourcing can also provide targeted expertise without replacing the organisation’s established internal audit function.
Acumon works with organisations that are:
- Establishing an internal audit function
- Strengthening governance frameworks
- Reviewing financial and operational controls
- Managing changing regulatory obligations
Early engagement can help define an appropriate internal audit plan, identify priority risk areas and establish a practical assurance programme that reflects the organisation’s governance structure and available internal resources. For Scottish organisations, this support can be delivered through Acumon’s UK-wide Risk & Technology Assurance practice alongside its presence in Aberdeen.
Contact Information
- Website: acumon.com
- Phone: 020 8567 3451
- Email: [email protected]
- Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Henderson Loggie
Henderson Loggie has a dedicated internal audit practice serving organisations from offices in Aberdeen, Dundee, Edinburgh and Glasgow. Its internal audit offering covers outsourced and co-sourced arrangements alongside consultancy assignments, giving organisations several ways to structure assurance work.
The practice works across public, private and third-sector organisations. Published areas of experience include further and higher education, local government, housing associations, research organisations and non-departmental public bodies. Its services extend beyond routine controls testing to governance, risk management and operational efficiency, which may suit Scottish organisations looking for a locally based team with substantial public-sector exposure.
Key Facts
- Ideal for: Public bodies, education organisations, housing providers and other Scottish organisations
- Core services: Outsourced internal audit, co-sourcing, consultancy, controls and compliance reviews
- Specialization: Public-sector internal audit and risk assurance
- Location: Aberdeen, Dundee, Edinburgh and Glasgow
- Sector experience: Education, local government, housing, research and NDPBs
- Notable strength: Dedicated internal audit team operating from four Scottish offices
Contact Information
- Website: hlca.co.uk
- Phone: 01224 322100
- Email: [email protected]
- Address: 1 Marischal Square, Broad Street, Aberdeen, AB10 1BL
- LinkedIn: www.linkedin.com/company/hendersonloggie
- Facebook: www.facebook.com/HendersonLoggie
- Instagram: www.instagram.com/hendersonloggie
Johnston Carmichael
Johnston Carmichael provides Risk Assurance and Internal Audit Services covering process and controls reviews, internal audit, corporate governance, third-party risk and technology assurance. Its internal audit work can be delivered on a fully outsourced or co-sourced basis, while individual reviews can also be undertaken when organisations need additional resources or specialist input.
The firm’s methodology looks beyond financial controls to operational, regulatory and technology risks. Its published materials also reference audit committee reporting, data analytics and quality assurance reviews. With its roots in Scotland and a substantial UK presence, Johnston Carmichael is particularly relevant to organisations looking for internal audit alongside broader risk, regulatory and technology assurance capabilities.
Key Facts
- Ideal for: Businesses and regulated organisations requiring broad risk assurance
- Core services: Internal audit, process and controls reviews, governance reviews, technology assurance
- Specialization: Risk assurance and internal controls
- Delivery models: Fully outsourced, co-sourced and individual reviews
- Industries: Financial services, energy, not-for-profit and other commercial sectors
- Notable strength: Combination of internal audit and wider risk assurance capabilities
Contact Information
- Website: johnstoncarmichael.com
- Phone: 01224 212222
- Address: Bishop’s Court, 29 Albyn Place, Aberdeen, AB10 1YL
- LinkedIn: www.linkedin.com/company/johnston-carmichael-chartered-accountants-and-business-advisers
- Facebook: www.facebook.com/JohnstonCarmichael
- Twitter: x.com/JC_Accountants
- Instagram: www.instagram.com/johnston_carmichael
Wylie & Bisset
Glasgow-based Wylie & Bisset maintains a dedicated internal audit practice covering education, social housing, charities, public-sector organisations and private businesses. The team evaluates internal controls while providing assurance around governance and risk management.
Its sector focus is particularly relevant for Scottish housing and education organisations. The firm’s internal audit practice is led by a Chartered Member of the Institute of Internal Auditors, and published work includes financial and non-financial reviews as well as IT-related assurance. This makes Wylie & Bisset a more sector-focused alternative to the larger multidisciplinary firms in this guide.
Key Facts
- Ideal for: Housing, education, charity and public-sector organisations
- Core services: Internal audit, controls reviews, governance and risk assurance
- Specialization: Social housing and education
- Location: Glasgow
- Delivery scope: Financial and non-financial internal audit
- Notable strength: Established specialist internal audit practice
Contact Information
- Website: wbg.co.uk
- Phone: 0141 566 7000
- Email: [email protected]
- Address: 168 Bath Street, Glasgow, G2 4TP
- LinkedIn: www.linkedin.com/company/wylie-&-bisset-llp
- Twitter: x.com/WbgAccountancy
Armstrong Watson
Armstrong Watson offers internal audit as part of its Audit & Assurance practice, supporting organisations across Scotland and northern England. The firm can work alongside an existing internal audit team through co-sourcing or take responsibility for the function through an outsourced arrangement.
Its internal audit programmes examine governance, operational processes and controls with the aim of providing boards and stakeholders with assurance over risk management. Armstrong Watson has Scottish offices in Glasgow, Edinburgh and Dumfries, giving the firm a physical presence across both the Central Belt and south of Scotland.
Key Facts
- Ideal for: Businesses, charities and other organisations seeking regional audit support
- Core services: Internal audit, statutory audit, assurance reviews and grant audits
- Specialization: Governance, operational processes and internal controls
- Delivery models: Co-sourced and outsourced
- Scottish locations: Glasgow, Edinburgh and Dumfries
- Notable strength: Regional presence combined with wider audit and assurance services
Contact Information
- Website: www.armstrongwatson.co.uk
- Phone: 0131 255 0130
- Email: [email protected]
- Address: 92-98 Fountainbridge, Edinburgh, EH3 9QA
- LinkedIn: www.linkedin.com/company/armstrong-watson
- Facebook: www.facebook.com/armstrongwatson
- Twitter: x.com/armstrongwatson
- Instagram: www.instagram.com/armstrongwatsonllp
Grant Thornton
Grant Thornton provides internal audit services through co-source, outsource and staff-support models. Its teams combine internal audit professionals with subject-matter specialists, allowing individual audit plans to address operational, regulatory, financial and technology risks rather than remaining limited to traditional financial controls.
The firm has offices in Edinburgh and Glasgow and maintains dedicated public-sector internal audit leadership for Scotland. Published Scottish experience includes healthcare and education, while its wider UK service includes external quality assessments and support for internal audit resource gaps. This combination makes Grant Thornton relevant to larger organisations and public bodies with complex assurance requirements.
Key Facts
- Ideal for: Public-sector bodies and organisations with complex assurance requirements
- Core services: Internal audit outsourcing, co-sourcing, EQA and resource support
- Specialization: Risk and internal audit
- Scottish locations: Edinburgh and Glasgow
- Sector experience: Public sector, healthcare and education
- Notable strength: Dedicated public-sector internal audit capability in Scotland
Contact Information
- Website: www.grantthornton.co.uk
- Phone: +44 (0)131 229 9181
- Email: [email protected]
- Address: 7 Castle Street, Edinburgh, EH2 3AH
- LinkedIn: www.linkedin.com/company/grant-thornton-uk
- Instagram: www.instagram.com/gt_trainees
BDO
BDO’s Risk Advisory practice provides internal audit services covering the design and operation of internal audit functions, risk assessment, controls evaluation and reporting to management, boards and other stakeholders. Delivery can be structured as an outsourced or co-sourced internal audit.
Its broader capabilities include external quality assurance reviews, audit committee advisory, continuous auditing and data analytics. BDO maintains offices in both Edinburgh and Glasgow, where its Scottish teams work with owner-managed businesses, private and listed groups, public-sector organisations, pension schemes and not-for-profit entities.
Key Facts
- Ideal for: Mid-sized and larger organisations requiring scalable internal audit
- Core services: Internal audit partnering, EQA, audit committee advisory and controls reviews
- Specialization: Risk advisory and governance
- Scottish locations: Edinburgh and Glasgow
- Client types: Private businesses, listed groups, public sector and not-for-profit organisations
- Notable strength: Access to multidisciplinary risk and technology expertise
Contact Information
- Website: www.bdo.co.uk
- Phone: 0131 347 0347
- Email: [email protected]
- Address: 30 Semple Street, Edinburgh, EH3 8BL, United Kingdom
- LinkedIn: www.linkedin.com/company/bdo-llp
- Instagram: www.instagram.com/bdo_uk
KPMG
KPMG provides end-to-end internal audit services covering strategy, function design, execution, testing and continuous assurance. Available capabilities include outsourced and co-sourced internal audit, assurance mapping, risk assessment, thematic reviews, external quality assessments and internal audit transformation.
The firm’s Edinburgh office explicitly provides internal audit support while working across Scotland, including with the Scottish Government, local authorities, educational institutions and healthcare providers. KPMG also maintains offices in Glasgow and Aberdeen, giving organisations access to local teams alongside the firm’s national and international specialist resources.
Key Facts
- Ideal for: Large, regulated and complex organisations
- Core services: Outsourced and co-sourced internal audit, EQA, audit planning and transformation
- Specialization: Enterprise risk, technology and regulatory assurance
- Scottish locations: Edinburgh, Glasgow and Aberdeen
- Client types: Corporate and public-sector organisations
- Notable strength: Broad risk and specialist technical capabilities
Contact Information
- Website: kpmg.com
- Phone: +44 (0) 141 226 5511
- Address: 319 St Vincent St, Glasgow G2 5LD
- LinkedIn: www.linkedin.com/company/kpmg-uk
- Twitter: x.com/kpmguk
Deloitte
Deloitte supports internal audit through outsourcing, co-sourcing and advisory models. A fully managed arrangement can cover the organisation’s internal audit function, while co-sourcing allows Deloitte specialists to supplement an established team or take responsibility for selected reviews.
Its internal audit capabilities extend into cyber risk, technology, third-party risk, GDPR, organisational culture, regulatory risk and quality assurance. Deloitte operates offices in Edinburgh, Glasgow and Aberdeen, providing a substantial physical footprint for organisations across Scotland.
Key Facts
- Ideal for: Large organisations with complex operational, technology or regulatory risks
- Core services: Internal audit outsourcing, co-sourcing, advisory and quality assurance
- Specialization: Technology-enabled internal audit and controls
- Scottish locations: Edinburgh, Glasgow and Aberdeen
- Additional capabilities: Cyber, digital risk, third-party risk and regulatory assurance
- Notable strength: Extensive subject-matter specialist network
Contact Information
- Website: www.deloitte.com
- Phone: +44 (0)141 204 2800
- Address: 110 Queen Street, Glasgow, G1 3BX, United Kingdom
- LinkedIn: www.linkedin.com/company/deloitte
- Facebook: www.facebook.com/deloitteuk
- Twitter: x.com/deloitteuk
PwC
PwC provides internal audit services focused on helping organisations understand changing risk exposures and strengthen their assurance capabilities. Its work can include establishing an internal audit capability, developing strategy, improving existing functions and executing audit programmes.
For organisations dealing with technology, regulatory change and large volumes of business data, PwC can combine internal audit with broader risk, cyber and assurance capabilities. The firm has offices in Edinburgh, Glasgow and Aberdeen, with more than 500 professionals reported at its Edinburgh office alone, supporting both public and private-sector organisations.
Key Facts
- Ideal for: Larger businesses and public-sector organisations
- Core services: Internal audit strategy, execution, enhancement and transformation
- Specialization: Risk, technology and data-enabled assurance
- Scottish locations: Edinburgh, Glasgow and Aberdeen
- Client types: Public and private-sector organisations
- Notable strength: Integration of internal audit with wider risk and technology capabilities
Contact Information
- Website: www.pwc.co.uk
- Phone: +44 (0)141 355 4000
- Address: 120 Bothwell Street, Glasgow, G2 7JS
- LinkedIn: www.linkedin.com/company/pwc-uk
- Facebook: www.facebook.com/PwCUK
- Instagram: www.instagram.com/pwc_uk
Forvis Mazars
Forvis Mazars provides internal audit through its Risk Consulting practice. Its approach covers the development of new internal audit functions as well as support for existing teams, using risk-based programmes tailored to organisational structure, industry and assurance requirements.
Related capabilities include governance, risk management, compliance, internal controls and technology assurance. The firm has offices in Edinburgh and Glasgow, while a Scotland-based Risk Consulting partner brings experience in internal audit, governance and risk transformation across financial services, real estate, public-sector and private-sector organisations.
Key Facts
- Ideal for: Mid-market, public-sector and regulated organisations
- Core services: Internal audit, governance, risk management and compliance reviews
- Specialization: Risk consulting and internal controls
- Scottish locations: Edinburgh and Glasgow
- Additional capabilities: Technology assurance and board effectiveness reviews
- Notable strength: Scotland-based risk assurance leadership
Contact Information
- Website: www.forvismazars.com
- Phone: +44 131 313 7900
- Address: 58 Morrison Street, Edinburgh, EH3 8BP, United Kingdom
- LinkedIn: www.linkedin.com/company/forvis-mazars-in-the-uk
- Twitter: x.com/ForvisMazarsUK
- Instagram: www.instagram.com/forvismazarsuk
- Facebook: www.facebook.com/ForvisMazarsGroup
RSM
RSM provides outsourced and co-sourced internal audit services designed to identify and address strategic, financial and operational risks. The work sits within a wider audit and consulting offering, allowing organisations to combine internal audit with specialist controls and advisory support where necessary.
The firm maintains offices in Edinburgh and Glasgow. This physical Scottish presence, combined with its wider UK internal audit resources, makes RSM relevant to businesses looking for a larger multidisciplinary provider without limiting the engagement to financial statement assurance.
Key Facts
- Ideal for: Mid-market and larger organisations
- Core services: Outsourced and co-sourced internal audit, controls and risk assurance
- Specialization: Strategic, operational and financial risk
- Scottish locations: Edinburgh and Glasgow
- Delivery model: National resources with Scottish offices
- Notable strength: Integration with wider audit, tax and consulting capabilities
Contact Information
- Website: www.rsmuk.com
- Email: [email protected]
- Phone: +44 (0)131 659 8300
- Address: 3rd Floor, 2 Semple Street, Edinburgh, EH3 8BL
- LinkedIn: www.linkedin.com/company/rsm-uk
- Instagram: www.instagram.com/rsm.uk
EY
EY’s internal audit services focus on transformation, co-sourcing and managed service models. Its teams can assess an existing internal audit function, help define a future operating model and provide industry or risk-domain specialists to support audit delivery.
Technology and analytics are prominent within the offering, including controls testing and digitally enabled internal audit processes. EY has a substantial Scottish operation with offices in Edinburgh, Glasgow and Aberdeen, serving private businesses, large corporates, public-sector organisations and government. This scale makes the firm most relevant where internal audit needs to connect with broader technology, controls or transformation programmes.
Key Facts
- Ideal for: Large organisations and businesses transforming internal audit
- Core services: Internal audit transformation, co-sourcing and managed services
- Specialization: Technology-enabled internal audit and controls
- Scottish locations: Edinburgh, Glasgow and Aberdeen
- Client types: Private companies, PLCs, public sector and government
- Notable strength: Internal audit transformation combined with analytics and technology
Contact Information
- Website: www.ey.com
- Phone: +44 20 7951 2000
- Address: Atria One, 144 Morrison Street, Edinburgh EH3 8EX
- LinkedIn: www.linkedin.com/company/ernstandyoung
- Facebook: www.facebook.com/EY
- Twitter: x.com/EYnews
Conclusion
Internal audit providers in Scotland vary considerably in scale and focus. Some maintain dedicated Scottish internal audit teams with extensive public-sector, education or housing experience, while others provide national and international specialist resources for technology, financial services, governance and regulatory risk.
The appropriate provider depends on whether the organisation needs a complete outsourced function, additional co-sourced capacity or a focused review of a particular risk area. Scottish organisations should also compare sector experience, reporting arrangements, specialist capabilities and independence requirements before appointing an internal audit provider.