Internal Audit Companies in Scotland: A Practical Selection Guide (2026)
AC
Acumon Chartered Accountants·13 min read
This practical guide presents companies offering internal audit services in Scotland, rather than ranking them from first to last. The selection includes larger companies with broad audit, risk and assurance capabilities alongside more focused specialists working in particular sectors or areas of internal control. Each company brings a different mix of experience, service scope and client focus. The aim is to give useful context on who these companies are, the organisations they serve and the strengths relevant to internal audit engagements. This overview can help readers compare available options and identify companies that fit their specific assurance, governance and risk requirements.
Acumon
Acumon is a UK company of chartered accountants, auditors and advisors providing internal audit services as part of its Risk & Technology Assurance practice. The company supports organisations that need independent reviews of governance, risk management, operational processes and internal controls, including businesses that do not maintain a permanent in-house internal audit function.
Internal audit engagements can be structured as fully outsourced, co-sourced or ad-hoc assignments. A fully outsourced arrangement can cover annual audit planning, individual reviews, management action tracking and reporting to the audit committee, while co-sourcing allows Acumon specialists to work alongside an organisation’s existing internal audit team.
For organisations in Scotland, Acumon combines UK-wide service coverage with a direct Scottish presence. The company lists Aberdeen among its UK offices, and its team includes an Audit Partner and Head of Scotland. This gives Scottish organisations access to local leadership alongside the wider audit, risk and technology assurance resources of the company.
Internal audit work can extend beyond financial processes to areas such as governance, IT risk, fraud prevention, regulatory compliance and operational controls. Acumon’s wider Risk & Technology Assurance practice also addresses evolving governance requirements, including board-level expectations concerning the effectiveness of material internal controls.
The internal audit service is relevant to a range of organisational structures, including commercial businesses, charities, academy trusts and regulated organisations. Acumon notes that outsourced arrangements can be proportionate to the organisation, including focused programmes consisting of selected reviews rather than a permanent internal audit function.
Acumon works with management teams, boards and audit committees to provide independent assurance over risk and controls. Engagements can therefore be used both by Scottish organisations establishing an internal audit function and by organisations that already have internal audit resources but require additional capacity or specialist expertise.
Internal Audit Capabilities
Acumon provides internal audit services that can be adapted to an organisation’s governance structure, risk profile and existing assurance arrangements.
These include:
Fully outsourced internal audit functions
Co-sourced internal audit support
Risk-based internal audit planning
Governance and internal control reviews
Management action tracking
Audit committee reporting
Internal audit engagements are supported by senior professionals and can draw on specialist expertise where reviews involve areas such as technology risk, fraud, governance or financial controls.
Regulatory Licences and Registrations
Acumon’s wider audit practice holds UK and international registrations relevant to organisations operating within regulated or multi-jurisdictional structures.
These include:
UK statutory audit registration
Public Interest Entity (PIE) audit authorisation
Jersey audit recognition
Isle of Man audit recognition
Cayman Islands audit licence
British Virgin Islands audit licence
These registrations relate primarily to Acumon’s external audit work rather than being requirements for internal audit engagements. They nevertheless reflect the company’s wider experience of working with regulated entities and organisations whose governance and assurance requirements extend across multiple jurisdictions.
Core Services
In addition to internal audit, Acumon provides related audit, governance, risk and technology assurance services that can support organisations with broader control and compliance requirements.
These include:
Internal audit outsourcing
Co-sourced internal audit
Governance and internal control reviews
IT audit and technology assurance
Risk management and compliance support
Statutory external audit
Group and subsidiary audits
Internal audit work is often connected with discussions involving management, boards and audit committees about governance arrangements, risk exposure, control effectiveness and outstanding management actions. The scope can be adjusted according to the organisation’s size, regulatory environment and existing assurance resources.
Organisations may consider additional internal audit support when operations expand, governance responsibilities become more complex or existing teams lack the capacity or specialist knowledge required for particular areas of the audit plan. Co-sourcing can also provide targeted expertise without replacing the organisation’s established internal audit function.
Acumon works with organisations that are:
Establishing an internal audit function
Strengthening governance frameworks
Reviewing financial and operational controls
Managing changing regulatory obligations
Early engagement can help define an appropriate internal audit plan, identify priority risk areas and establish a practical assurance programme that reflects the organisation’s governance structure and available internal resources. For Scottish organisations, this support can be delivered through Acumon’s UK-wide Risk & Technology Assurance practice alongside its presence in Aberdeen.
Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Henderson Loggie
Henderson Loggie has a dedicated internal audit practice serving organisations from offices in Aberdeen, Dundee, Edinburgh and Glasgow. Its internal audit offering covers outsourced and co-sourced arrangements alongside consultancy assignments, giving organisations several ways to structure assurance work.
The practice works across public, private and third-sector organisations. Published areas of experience include further and higher education, local government, housing associations, research organisations and non-departmental public bodies. Its services extend beyond routine controls testing to governance, risk management and operational efficiency, which may suit Scottish organisations looking for a locally based team with substantial public-sector exposure.
Key Facts
Ideal for: Public bodies, education organisations, housing providers and other Scottish organisations
Johnston Carmichael provides Risk Assurance and Internal Audit Services covering process and controls reviews, internal audit, corporate governance, third-party risk and technology assurance. Its internal audit work can be delivered on a fully outsourced or co-sourced basis, while individual reviews can also be undertaken when organisations need additional resources or specialist input.
The firm’s methodology looks beyond financial controls to operational, regulatory and technology risks. Its published materials also reference audit committee reporting, data analytics and quality assurance reviews. With its roots in Scotland and a substantial UK presence, Johnston Carmichael is particularly relevant to organisations looking for internal audit alongside broader risk, regulatory and technology assurance capabilities.
Key Facts
Ideal for: Businesses and regulated organisations requiring broad risk assurance
Core services: Internal audit, process and controls reviews, governance reviews, technology assurance
Specialization: Risk assurance and internal controls
Delivery models: Fully outsourced, co-sourced and individual reviews
Industries: Financial services, energy, not-for-profit and other commercial sectors
Notable strength: Combination of internal audit and wider risk assurance capabilities
Glasgow-based Wylie & Bisset maintains a dedicated internal audit practice covering education, social housing, charities, public-sector organisations and private businesses. The team evaluates internal controls while providing assurance around governance and risk management.
Its sector focus is particularly relevant for Scottish housing and education organisations. The firm’s internal audit practice is led by a Chartered Member of the Institute of Internal Auditors, and published work includes financial and non-financial reviews as well as IT-related assurance. This makes Wylie & Bisset a more sector-focused alternative to the larger multidisciplinary firms in this guide.
Key Facts
Ideal for: Housing, education, charity and public-sector organisations
Core services: Internal audit, controls reviews, governance and risk assurance
Specialization: Social housing and education
Location: Glasgow
Delivery scope: Financial and non-financial internal audit
Notable strength: Established specialist internal audit practice
Armstrong Watson offers internal audit as part of its Audit & Assurance practice, supporting organisations across Scotland and northern England. The firm can work alongside an existing internal audit team through co-sourcing or take responsibility for the function through an outsourced arrangement.
Its internal audit programmes examine governance, operational processes and controls with the aim of providing boards and stakeholders with assurance over risk management. Armstrong Watson has Scottish offices in Glasgow, Edinburgh and Dumfries, giving the firm a physical presence across both the Central Belt and south of Scotland.
Key Facts
Ideal for: Businesses, charities and other organisations seeking regional audit support
Core services: Internal audit, statutory audit, assurance reviews and grant audits
Specialization: Governance, operational processes and internal controls
Delivery models: Co-sourced and outsourced
Scottish locations: Glasgow, Edinburgh and Dumfries
Notable strength: Regional presence combined with wider audit and assurance services
Grant Thornton provides internal audit services through co-source, outsource and staff-support models. Its teams combine internal audit professionals with subject-matter specialists, allowing individual audit plans to address operational, regulatory, financial and technology risks rather than remaining limited to traditional financial controls.
The firm has offices in Edinburgh and Glasgow and maintains dedicated public-sector internal audit leadership for Scotland. Published Scottish experience includes healthcare and education, while its wider UK service includes external quality assessments and support for internal audit resource gaps. This combination makes Grant Thornton relevant to larger organisations and public bodies with complex assurance requirements.
Key Facts
Ideal for: Public-sector bodies and organisations with complex assurance requirements
Core services: Internal audit outsourcing, co-sourcing, EQA and resource support
Specialization: Risk and internal audit
Scottish locations: Edinburgh and Glasgow
Sector experience: Public sector, healthcare and education
Notable strength: Dedicated public-sector internal audit capability in Scotland
BDO’s Risk Advisory practice provides internal audit services covering the design and operation of internal audit functions, risk assessment, controls evaluation and reporting to management, boards and other stakeholders. Delivery can be structured as an outsourced or co-sourced internal audit.
Its broader capabilities include external quality assurance reviews, audit committee advisory, continuous auditing and data analytics. BDO maintains offices in both Edinburgh and Glasgow, where its Scottish teams work with owner-managed businesses, private and listed groups, public-sector organisations, pension schemes and not-for-profit entities.
Key Facts
Ideal for: Mid-sized and larger organisations requiring scalable internal audit
Address: 30 Semple Street, Edinburgh, EH3 8BL, United Kingdom
LinkedIn: www.linkedin.com/company/bdo-llp
Instagram: www.instagram.com/bdo_uk
KPMG
KPMG provides end-to-end internal audit services covering strategy, function design, execution, testing and continuous assurance. Available capabilities include outsourced and co-sourced internal audit, assurance mapping, risk assessment, thematic reviews, external quality assessments and internal audit transformation.
The firm’s Edinburgh office explicitly provides internal audit support while working across Scotland, including with the Scottish Government, local authorities, educational institutions and healthcare providers. KPMG also maintains offices in Glasgow and Aberdeen, giving organisations access to local teams alongside the firm’s national and international specialist resources.
Key Facts
Ideal for: Large, regulated and complex organisations
Core services: Outsourced and co-sourced internal audit, EQA, audit planning and transformation
Specialization: Enterprise risk, technology and regulatory assurance
Scottish locations: Edinburgh, Glasgow and Aberdeen
Client types: Corporate and public-sector organisations
Notable strength: Broad risk and specialist technical capabilities
Contact Information
Website: kpmg.com
Phone: +44 (0) 141 226 5511
Address: 319 St Vincent St, Glasgow G2 5LD
LinkedIn: www.linkedin.com/company/kpmg-uk
Twitter: x.com/kpmguk
Deloitte
Deloitte supports internal audit through outsourcing, co-sourcing and advisory models. A fully managed arrangement can cover the organisation’s internal audit function, while co-sourcing allows Deloitte specialists to supplement an established team or take responsibility for selected reviews.
Its internal audit capabilities extend into cyber risk, technology, third-party risk, GDPR, organisational culture, regulatory risk and quality assurance. Deloitte operates offices in Edinburgh, Glasgow and Aberdeen, providing a substantial physical footprint for organisations across Scotland.
Key Facts
Ideal for: Large organisations with complex operational, technology or regulatory risks
Core services: Internal audit outsourcing, co-sourcing, advisory and quality assurance
Specialization: Technology-enabled internal audit and controls
Scottish locations: Edinburgh, Glasgow and Aberdeen
Additional capabilities: Cyber, digital risk, third-party risk and regulatory assurance
Address: 110 Queen Street, Glasgow, G1 3BX, United Kingdom
LinkedIn: www.linkedin.com/company/deloitte
Facebook: www.facebook.com/deloitteuk
Twitter: x.com/deloitteuk
PwC
PwC provides internal audit services focused on helping organisations understand changing risk exposures and strengthen their assurance capabilities. Its work can include establishing an internal audit capability, developing strategy, improving existing functions and executing audit programmes.
For organisations dealing with technology, regulatory change and large volumes of business data, PwC can combine internal audit with broader risk, cyber and assurance capabilities. The firm has offices in Edinburgh, Glasgow and Aberdeen, with more than 500 professionals reported at its Edinburgh office alone, supporting both public and private-sector organisations.
Key Facts
Ideal for: Larger businesses and public-sector organisations
Core services: Internal audit strategy, execution, enhancement and transformation
Specialization: Risk, technology and data-enabled assurance
Scottish locations: Edinburgh, Glasgow and Aberdeen
Client types: Public and private-sector organisations
Notable strength: Integration of internal audit with wider risk and technology capabilities
Contact Information
Website: www.pwc.co.uk
Phone: +44 (0)141 355 4000
Address: 120 Bothwell Street, Glasgow, G2 7JS
LinkedIn: www.linkedin.com/company/pwc-uk
Facebook: www.facebook.com/PwCUK
Instagram: www.instagram.com/pwc_uk
Forvis Mazars
Forvis Mazars provides internal audit through its Risk Consulting practice. Its approach covers the development of new internal audit functions as well as support for existing teams, using risk-based programmes tailored to organisational structure, industry and assurance requirements.
Related capabilities include governance, risk management, compliance, internal controls and technology assurance. The firm has offices in Edinburgh and Glasgow, while a Scotland-based Risk Consulting partner brings experience in internal audit, governance and risk transformation across financial services, real estate, public-sector and private-sector organisations.
Key Facts
Ideal for: Mid-market, public-sector and regulated organisations
Core services: Internal audit, governance, risk management and compliance reviews
Specialization: Risk consulting and internal controls
Scottish locations: Edinburgh and Glasgow
Additional capabilities: Technology assurance and board effectiveness reviews
RSM provides outsourced and co-sourced internal audit services designed to identify and address strategic, financial and operational risks. The work sits within a wider audit and consulting offering, allowing organisations to combine internal audit with specialist controls and advisory support where necessary.
The firm maintains offices in Edinburgh and Glasgow. This physical Scottish presence, combined with its wider UK internal audit resources, makes RSM relevant to businesses looking for a larger multidisciplinary provider without limiting the engagement to financial statement assurance.
Key Facts
Ideal for: Mid-market and larger organisations
Core services: Outsourced and co-sourced internal audit, controls and risk assurance
Specialization: Strategic, operational and financial risk
Scottish locations: Edinburgh and Glasgow
Delivery model: National resources with Scottish offices
Notable strength: Integration with wider audit, tax and consulting capabilities
EY’s internal audit services focus on transformation, co-sourcing and managed service models. Its teams can assess an existing internal audit function, help define a future operating model and provide industry or risk-domain specialists to support audit delivery.
Technology and analytics are prominent within the offering, including controls testing and digitally enabled internal audit processes. EY has a substantial Scottish operation with offices in Edinburgh, Glasgow and Aberdeen, serving private businesses, large corporates, public-sector organisations and government. This scale makes the firm most relevant where internal audit needs to connect with broader technology, controls or transformation programmes.
Key Facts
Ideal for: Large organisations and businesses transforming internal audit
Core services: Internal audit transformation, co-sourcing and managed services
Specialization: Technology-enabled internal audit and controls
Scottish locations: Edinburgh, Glasgow and Aberdeen
Client types: Private companies, PLCs, public sector and government
Notable strength: Internal audit transformation combined with analytics and technology
Internal audit providers in Scotland vary considerably in scale and focus. Some maintain dedicated Scottish internal audit teams with extensive public-sector, education or housing experience, while others provide national and international specialist resources for technology, financial services, governance and regulatory risk.
The appropriate provider depends on whether the organisation needs a complete outsourced function, additional co-sourced capacity or a focused review of a particular risk area. Scottish organisations should also compare sector experience, reporting arrangements, specialist capabilities and independence requirements before appointing an internal audit provider.
AC
Written by the Acumon team
Acumon is an ICAEW-registered firm of chartered accountants and registered auditors
based in London, with offices in Pitstone, Aylesbury and Bournemouth. Need advice on
anything covered here? Talk to us.
Statutory Sick Pay (SSP) is the minimum an employer must pay an employee who is too ill to work. For 2026/27 it is £123.25 a week or 80% of the employee's average weekly earnings, whichever is…
A UTR number is your Unique Taxpayer Reference : a 10-digit number HMRC issues when you register for Self Assessment or set up a limited company. It identifies your tax records for Self Assessment…
A P60 is the end-of-year certificate your employer gives you. It shows your total pay and the income tax and National Insurance deducted from it during the tax year, which runs from 6 April to 5…
Read article
Get in Touch
Ready for Accountants Who Move Your Business Forward?
Tell us what you need. Within one business day, a qualified accountant will be in touch to talk it through and give you a clear, fixed-fee quote — no obligation.
We use essential cookies to run this site, plus Google Analytics and Google Ads to
understand how visitors use it and measure our advertising — only with your consent. See our
Privacy Policy.
