The role of internal audit/an internal auditor is to provide independent assurance that an organization’s risk management, governance and internal control processes are operating effectively, according to the Institute of Internal Auditors. Internal audit is the third line of defense in the three lines of defense (3LoD) model. An external auditor usually reviews only the firm’s financial statements, and is brought in from an outside organization that provides assurance services.